The auth thing was the main thing I questioned (aside from over-engineering, but my own site is guilty of that too). I thought part of the benefits of auth ser

The auth thing was the main thing I questioned (aside from over-engineering, but my own site is guilty of that too). I thought part of the benefits of auth services like auth0 is that due to them having to provided some kind of trusted token containing an identity payload (eg a JWT), you can get away without having the query the auth service per-request (assuming you can tolerate stale tokens in the event of a permission change). So the performance issue being used to justify hand-rolled auth, seems to be the result of a misunderstanding.