Clarify types in auth