Add out-of-band auth, + always call a callback

Just curious, why 
return _successHandler
instead of 
_successHandler
return

?