Refactor auth a bit to allow specification of the root user id rather
than pulling it from the request context.