improve authentication and authorization

Proxy authentication seems to generate a lot of nonces quickly when iOS device is the client

dissect the authentication code, follow all paths using unexpected/attack inputs, test same

dissect and document where the authorization code is and how it works