Move all auth stuff into `Shadow` class.