I got most of the difficult stuff out of the way while refactoring the auth layer.