Break auth from app and add tests

Does what it says on the tin.