Auth code can now be specified as a constructor option (like everything else can);
#callback_phase tests are much more comprehensive