Improve strict auth API so that we can require both a unique auth key and a genuine user interaction#134