Base implementation

As said before, don't pass the raw request to the auth service: dealing with HTTP is a controller problem. Instead, pass in a DTO that abstracts field values away