Better auth picking. Have can_auth() take an optional host.