Refactored `auth()` to support stateless & stateful strategies at the same time, fixes #13 (failing test has to wait until later - don't use this sha!)