diff --git a/pkg/auth/authenticator.go b/pkg/auth/authenticator.go
index 8056c9f..3ec792d 100644
--- a/pkg/auth/authenticator.go
+++ b/pkg/auth/authenticator.go
@@ -20,9 +20,9 @@ var (
 )
 
 type Authenticator struct {
-	Flows     FlowStore
-	Sessions  SessionStore
-	Providers map[string]AuthProvider
+	flows     FlowStore
+	sessions  SessionStore
+	providers map[string]AuthProvider
 }
 
 func (a *Authenticator) InstallRoutes(e *echo.Echo) {
@@ -40,7 +40,7 @@ func (a *Authenticator) InstallRoutes(e *echo.Echo) {
 }
 
 func (a *Authenticator) Provider(name string) AuthProvider {
-	p, ok := a.Providers[name]
+	p, ok := a.providers[name]
 	if !ok {
 		return nil
 	}
@@ -49,15 +49,15 @@ func (a *Authenticator) Provider(name string) AuthProvider {
 }
 
 func (a *Authenticator) InitAuth(s storage.Store) error {
-	a.Flows = make(FlowStore)
-	a.Sessions.init()
+	a.flows = make(FlowStore)
+	a.sessions.init()
 	hap, err := NewHAProvider(s)
 	if err != nil {
 		return err
 	}
 
 	// XXX: yuck
-	a.Providers = map[string]AuthProvider{
+	a.providers = map[string]AuthProvider{
 		hap.ProviderType(): hap,
 	}
 
diff --git a/pkg/auth/flow.go b/pkg/auth/flow.go
index f732976..f94b1e7 100644
--- a/pkg/auth/flow.go
+++ b/pkg/auth/flow.go
@@ -114,7 +114,7 @@ func (a *Authenticator) NewFlow(r *FlowRequest) *Flow {
 	}
 	flow.touch()
 
-	a.Flows.register(flow)
+	a.flows.register(flow)
 
 	return flow
 }
@@ -159,7 +159,7 @@ func (f *Flow) progress(a *Authenticator, c echo.Context) error {
 				Version int       `json:"version"`
 			}
 			// TODO: setup the session. delete the flow.
-			a.Flows.Remove(f)
+			a.flows.Remove(f)
 			copier.Copy(&finishedFlow, f)
 			finishedFlow.Type = TypeCreateEntry
 			finishedFlow.Title = common.AppName
@@ -191,7 +191,7 @@ func (a *Authenticator) LoginFlowDeleteHandler(c echo.Context) error {
 		return c.String(http.StatusBadRequest, "empty flow ID")
 	}
 
-	delete(a.Flows, FlowID(flowID))
+	delete(a.flows, FlowID(flowID))
 
 	return c.String(http.StatusOK, "deleted")
 }
@@ -226,13 +226,13 @@ func (a *Authenticator) LoginFlowHandler(c echo.Context) error {
 
 	flowID := c.Param("flow_id")
 
-	flow := a.Flows.Get(FlowID(flowID))
+	flow := a.flows.Get(FlowID(flowID))
 	if flow == nil {
 		return c.String(http.StatusNotFound, "no such flow")
 	}
 
 	if time.Now().Sub(flow.ctime) > cullAge {
-		a.Flows.Remove(flow)
+		a.flows.Remove(flow)
 
 		return c.String(http.StatusGone, "flow timed out")
 	}
diff --git a/pkg/auth/session.go b/pkg/auth/session.go
index 2dc6624..799b2ae 100644
--- a/pkg/auth/session.go
+++ b/pkg/auth/session.go
@@ -65,7 +65,7 @@ func (a *Authenticator) NewToken(r *http.Request, f *Flow) TokenID {
 		Addr:    r.RemoteAddr,
 	}
 
-	a.Sessions.register(t)
+	a.sessions.register(t)
 
 	return id
 }
@@ -83,7 +83,7 @@ func (a *Authenticator) TokenHandler(c echo.Context) error {
 		return err
 	}
 
-	if a.Sessions.verify(&rq, c.Request()) {
+	if a.sessions.verify(&rq, c.Request()) {
 		// TODO: success
 		return c.String(http.StatusOK, "token good I guess")
 	}