The Auth object only captures the information we actually need and use, and it's nicer not to spread SSO handling all over the place.
