I think it would be a good idea to write the documentation.  It is much easier to get a feel for the API via docs than it is via code.  (That is, when you explain how to use the API, you sometimes find design bugs :)

for a/b: so you are thinking of an auth function passed in as opposed to a method overridden in the subclass?  That is consistent with how we enable other capabilities, so it has some attraction.

I haven't gone over the code in detail yet, but it looks like you need to add a reset of 'self.user' during the applicable state transitions.