Best practices in auth - Theo's Typesafe Cult