mostly mdotson's additions to auth, with genPasswordToken
ran with mdotson's idea for generic deserialization