Revamp auth, remove CSRF, etc