It would be much nicer is auth.strategy() was moved to the app instead of being called here. This would be a breaking change but now is that time for that.