authentication settings are now applied when creating and updating webapps

added unit tests
major refactor