s4-auth: make auth a private library