auth scopes; session reset; better errors