initial check-in of the new auth framework, still need to add session handling to identity + change the two entry points: remote control and authentication action