I've been writing this bomber scratch forum post about scratch auth