authenticators have optional success/failure redirects
authenticator code now has access to the hubba client
misc cleanup