this was a relic from the python version, i'd modeled the auth code off some random blog post back then.
web UI now uses modules, and relies less on bodge to make things work. Also fixes an issue where invites where "failed to send to xx" appeared in invite form.