use class names as auth names, rather than inventing variations
move SessionConfigResource to its own module, since it's not auth-related