correct order of operations

lib/relay.js

@@ -257,21 +257,31 @@ var Server = {
       newAuth = JSON.stringify(newAuth);
     }
 
+    // TODO don't fire the onAuth event on non-authz updates
+    if (!grant.jwt && !(grant.domains||[]).length && !(grant.ports||[]).length) {
+      return null;
+    }
+
     console.log('[onAuth] check for upgrade token');
-    if (grant.jwt && newAuth !== grant.jwt) {
+    if (grant.jwt) {
-      console.log('new token to send back');
+      if (newAuth !== grant.jwt) {
-      // Access Token
+        console.log('[onAuth] new token to send back');
-      Server.sendTunnelMsg(
+      }
-        srv
+      // TODO only send token when new
-      , null
+      if (true) {
-      , [ 3
+        // Access Token
-        , 'access_token'
+        Server.sendTunnelMsg(
-        , { jwt: grant.jwt }
+          srv
-        ]
+        , null
-      , 'control'
+        , [ 3
-      );
+          , 'access_token'
-      // these aren't needed internally once they're sent
+          , { jwt: grant.jwt }
-      grant.jwt = null;
+          ]
+        , 'control'
+        );
+        // these aren't needed internally once they're sent
+        grant.jwt = null;
+      }
     }
 
     /*
@@ -425,22 +435,24 @@ var Server = {
     }
 
     return state.authenticate({ auth: newAuth }).then(function (authnToken) {
-
       console.log('\n[relay.js] newAuth');
       console.log(newAuth);
 
       console.log('\n[relay.js] authnToken');
       console.log(authnToken);
 
-      if (authnToken.id) {
+      // For tracking state between token exchanges
-        state.srvs[authnToken.id] = state.srvs[authnToken.id] || {};
+      // and tacking on extra attributes (i.e. for extensions)
+      // TODO close on delete
+      if (!state.srvs[authnToken.id]) {
+        state.srvs[authnToken.id] = {};
+      }
+      if (!state.srvs[authnToken.id].updateAuth) {
         state.srvs[authnToken.id].updateAuth = function (validToken) {
           return Server.onAuth(state, srv, newAuth, validToken);
         };
       }
-
+      state.srvs[authnToken.id].updateAuth(authnToken);
-      // will return rejection if necessary
-      return state.srvs[authnToken.id].updateAuth(authnToken);
     });
   }
 , removeToken: function removeToken(state, srv, jwtoken) {