Make strategies interchangeable

Remove the specific dependance on url
Both strategies curry an instance of the auth app.
Fix test to actually make an assertion.