sknebelhm, thinking about the structure of the AutoAuth document. Wondering if it makes sense to reorder it and start with just the server-to-server part, and then in a second section add the bits that allow a client to do it (vs an integrated component that doesn't need to)
