Rolling my own auth ended up being a mistake...