The `getAuthKey` and `validate` utilities appear to be mostly internally used -- that is, the `getAuthKey` content is stashed in the session and the same content is passed to `validate` in future requests.

Shouldn't your provide a basic implementation in the abstract StaffAutheticationBackend and UserAuthenticationBackend classes so that only backends with special needs will need to define the functionality. Otherwise, it seems you're requiring each backend to copy+paste code to keep users logged in.