allowing auth packages, refactor in progress
allowing upper and lower case package names
aggregate via path name not mod name