This is just a nice cleanup, but it also supports a test mock I want to do next, to mock logins for the test db without having to round-trip to auth0.
