These two authentication mechanisms are starting to duplicate each others code in places; for example building a return url is now present in a nearly matching routine for both. We should factor out the similar routines into their own module.