make sure we're following auth best practices

[brianplynn]

this is my first time building an auth system so if you have exp in this area I would appreciate a set of fresh eyes to make sure I'm doing everything correctly!