Surely there must be a better way to handle auth/SSO than "make every command-line tool open a browser tab".