diff --git a/api/authmethods/account.gen.go b/api/authmethods/account.gen.go
index 012bd62c5..c9fb7fcce 100644
--- a/api/authmethods/account.gen.go
+++ b/api/authmethods/account.gen.go
@@ -23,15 +23,15 @@ type Account struct {
 	Attributes   map[string]interface{} `json:"attributes,omitempty"`
 }
 
-type accountClient struct {
+type accountsClient struct {
 	client *api.Client
 }
 
-func NewAccountClient(c *api.Client) *accountClient {
-	return &accountClient{client: c}
+func NewAccountsClient(c *api.Client) *accountsClient {
+	return &accountsClient{client: c}
 }
 
-func (c *accountClient) Create(ctx context.Context, authMethodId string, opt ...Option) (*Account, *api.Error, error) {
+func (c *accountsClient) Create(ctx context.Context, authMethodId string, opt ...Option) (*Account, *api.Error, error) {
 	if authMethodId == "" {
 		return nil, nil, fmt.Errorf("empty authMethodId value passed into Create request")
 	}
@@ -61,7 +61,7 @@ func (c *accountClient) Create(ctx context.Context, authMethodId string, opt ...
 	return target, apiErr, nil
 }
 
-func (c *accountClient) Read(ctx context.Context, authMethodId string, accountId string, opt ...Option) (*Account, *api.Error, error) {
+func (c *accountsClient) Read(ctx context.Context, authMethodId string, accountId string, opt ...Option) (*Account, *api.Error, error) {
 	if authMethodId == "" {
 		return nil, nil, fmt.Errorf("empty authMethodId value passed into Read request")
 	}
@@ -95,7 +95,7 @@ func (c *accountClient) Read(ctx context.Context, authMethodId string, accountId
 	return target, apiErr, nil
 }
 
-func (c *accountClient) Update(ctx context.Context, authMethodId string, accountId string, version uint32, opt ...Option) (*Account, *api.Error, error) {
+func (c *accountsClient) Update(ctx context.Context, authMethodId string, accountId string, version uint32, opt ...Option) (*Account, *api.Error, error) {
 	if authMethodId == "" {
 		return nil, nil, fmt.Errorf("empty authMethodId value passed into Update request")
 	}
@@ -127,7 +127,7 @@ func (c *accountClient) Update(ctx context.Context, authMethodId string, account
 	return target, apiErr, nil
 }
 
-func (c *accountClient) Delete(ctx context.Context, authMethodId string, accountId string, opt ...Option) (bool, *api.Error, error) {
+func (c *accountsClient) Delete(ctx context.Context, authMethodId string, accountId string, opt ...Option) (bool, *api.Error, error) {
 	if authMethodId == "" {
 		return false, nil, fmt.Errorf("empty authMethodId value passed into Delete request")
 	}
@@ -164,7 +164,7 @@ func (c *accountClient) Delete(ctx context.Context, authMethodId string, account
 	return target.Existed, apiErr, nil
 }
 
-func (c *accountClient) List(ctx context.Context, authMethodId string, opt ...Option) ([]*Account, *api.Error, error) {
+func (c *accountsClient) List(ctx context.Context, authMethodId string, opt ...Option) ([]*Account, *api.Error, error) {
 	if authMethodId == "" {
 		return nil, nil, fmt.Errorf("empty authMethodId value passed into List request")
 	}
diff --git a/api/authmethods/authmethods.gen.go b/api/authmethods/authmethods.gen.go
index a5304fe17..fc67ee037 100644
--- a/api/authmethods/authmethods.gen.go
+++ b/api/authmethods/authmethods.gen.go
@@ -21,15 +21,15 @@ type AuthMethod struct {
 	Attributes  map[string]interface{} `json:"attributes,omitempty"`
 }
 
-type authmethodClient struct {
+type authmethodsClient struct {
 	client *api.Client
 }
 
-func NewAuthMethodClient(c *api.Client) *authmethodClient {
-	return &authmethodClient{client: c}
+func NewAuthMethodsClient(c *api.Client) *authmethodsClient {
+	return &authmethodsClient{client: c}
 }
 
-func (c *authmethodClient) Create(ctx context.Context, opt ...Option) (*AuthMethod, *api.Error, error) {
+func (c *authmethodsClient) Create(ctx context.Context, opt ...Option) (*AuthMethod, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -55,7 +55,7 @@ func (c *authmethodClient) Create(ctx context.Context, opt ...Option) (*AuthMeth
 	return target, apiErr, nil
 }
 
-func (c *authmethodClient) Read(ctx context.Context, authMethodId string, opt ...Option) (*AuthMethod, *api.Error, error) {
+func (c *authmethodsClient) Read(ctx context.Context, authMethodId string, opt ...Option) (*AuthMethod, *api.Error, error) {
 	if authMethodId == "" {
 		return nil, nil, fmt.Errorf("empty authMethodId value passed into Read request")
 	}
@@ -85,7 +85,7 @@ func (c *authmethodClient) Read(ctx context.Context, authMethodId string, opt ..
 	return target, apiErr, nil
 }
 
-func (c *authmethodClient) Update(ctx context.Context, authMethodId string, version uint32, opt ...Option) (*AuthMethod, *api.Error, error) {
+func (c *authmethodsClient) Update(ctx context.Context, authMethodId string, version uint32, opt ...Option) (*AuthMethod, *api.Error, error) {
 	if authMethodId == "" {
 		return nil, nil, fmt.Errorf("empty authMethodId value passed into Update request")
 	}
@@ -114,7 +114,7 @@ func (c *authmethodClient) Update(ctx context.Context, authMethodId string, vers
 	return target, apiErr, nil
 }
 
-func (c *authmethodClient) Delete(ctx context.Context, authMethodId string, opt ...Option) (bool, *api.Error, error) {
+func (c *authmethodsClient) Delete(ctx context.Context, authMethodId string, opt ...Option) (bool, *api.Error, error) {
 	if authMethodId == "" {
 		return false, nil, fmt.Errorf("empty authMethodId value passed into Delete request")
 	}
@@ -147,7 +147,7 @@ func (c *authmethodClient) Delete(ctx context.Context, authMethodId string, opt
 	return target.Existed, apiErr, nil
 }
 
-func (c *authmethodClient) List(ctx context.Context, opt ...Option) ([]*AuthMethod, *api.Error, error) {
+func (c *authmethodsClient) List(ctx context.Context, opt ...Option) ([]*AuthMethod, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
diff --git a/api/authtokens/authtoken_test.go b/api/authtokens/authtoken_test.go
index 97c07ff7e..a0db49157 100644
--- a/api/authtokens/authtoken_test.go
+++ b/api/authtokens/authtoken_test.go
@@ -1,42 +1,58 @@
 package authtokens_test
 
-/*
+import (
+	"net/http"
+	"sort"
+	"testing"
+
+	"github.com/hashicorp/watchtower/api/authmethods"
+	"github.com/hashicorp/watchtower/api/authtokens"
+	"github.com/hashicorp/watchtower/internal/authtoken"
+	"github.com/hashicorp/watchtower/internal/servers/controller"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
 func TestAuthTokens_List(t *testing.T) {
-	assert := assert.New(t)
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{DisableAuthorizationFailures: true})
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultUsername:              "user",
+		DefaultPassword:              "passpass",
+	})
 	defer tc.Shutdown()
 
 	client := tc.Client()
-	org := &scopes.Org{
-		Client: client,
-	}
-	ctx := context.Background()
+	tokens := authtokens.NewAuthTokenClient(client)
+	methods := authmethods.NewAuthMethodClient(client)
 
-	atl, apiErr, err := org.ListAuthTokens(ctx)
-	assert.NoError(err)
+	atl, apiErr, err := tokens.List(tc.Context())
+	require.NoError(err)
 	assert.Nil(apiErr)
 	assert.Empty(atl)
 
 	var expected []*authtokens.AuthToken
 
-	at, apiErr, err := org.Authenticate(ctx, "am_1234567890", "name", "pw")
-	assert.NoError(err)
+	at, apiErr, err := methods.Authenticate(tc.Context(), amId, "user", "passpass")
+	require.NoError(err)
 	assert.Nil(apiErr)
 	expected = append(expected, at)
 
-	atl, apiErr, err = org.ListAuthTokens(ctx)
-	assert.NoError(err)
+	atl, apiErr, err = tokens.List(tc.Context())
+	require.NoError(err)
 	assert.Nil(apiErr)
 	assert.ElementsMatch(comparableSlice(expected), comparableSlice(atl))
 
 	for i := 1; i < 10; i++ {
-		at, apiErr, err = org.Authenticate(ctx, "am_1234567890", "name", "pw")
-		assert.NoError(err)
+		at, apiErr, err = methods.Authenticate(tc.Context(), amId, "user", "passpass")
+		require.NoError(err)
 		assert.Nil(apiErr)
 		expected = append(expected, at)
 	}
-	atl, apiErr, err = org.ListAuthTokens(ctx)
-	require.NoError(t, err)
+	atl, apiErr, err = tokens.List(tc.Context())
+	require.NoError(err)
 	assert.Nil(apiErr)
 	assert.ElementsMatch(comparableSlice(expected), comparableSlice(atl))
 }
@@ -65,52 +81,61 @@ func comparableSlice(in []*authtokens.AuthToken) []authtokens.AuthToken {
 }
 
 func TestAuthToken_Crud(t *testing.T) {
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{DisableAuthorizationFailures: true})
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultUsername:              "user",
+		DefaultPassword:              "passpass",
+	})
 	defer tc.Shutdown()
 
 	client := tc.Client()
-	org := &scopes.Org{
-		Client: client,
-	}
+	tokens := authtokens.NewAuthTokenClient(client)
+	methods := authmethods.NewAuthMethodClient(client)
 
-	want, apiErr, err := org.Authenticate(tc.Context(), "am_1234567890", "name", "pw")
+	want, apiErr, err := methods.Authenticate(tc.Context(), amId, "user", "passpass")
+	require.NoError(err)
+	assert.Empty(apiErr)
 
-	at, apiErr, err := org.ReadAuthToken(tc.Context(), &authtokens.AuthToken{Id: want.Id})
-	require.NoError(t, err)
-	assert.Nil(t, apiErr)
-	at.Token = ""
-	assert.EqualValues(t, comparableResource(want), comparableResource(at))
+	at, apiErr, err := tokens.Read(tc.Context(), want.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.EqualValues(comparableResource(want), comparableResource(at))
 
-	existed, _, err := org.DeleteAuthToken(tc.Context(), at)
-	require.NoError(t, err)
-	assert.Nil(t, apiErr)
-	assert.True(t, existed, "Expected existing user when deleted, but it wasn't.")
+	existed, _, err := tokens.Delete(tc.Context(), at.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.True(existed, "Expected existing user when deleted, but it wasn't.")
 
-	existed, apiErr, err = org.DeleteAuthToken(tc.Context(), at)
-	require.NoError(t, err)
-	assert.Nil(t, apiErr)
-	assert.False(t, existed, "Expected user to not exist when deleted, but it did.")
+	existed, apiErr, err = tokens.Delete(tc.Context(), at.Id)
+	require.NoError(err)
+	assert.Nil(apiErr)
+	assert.False(existed, "Expected user to not exist when deleted, but it did.")
 }
 
 func TestAuthToken_Errors(t *testing.T) {
-	assert := assert.New(t)
-	tc := controller.NewTestController(t, &controller.TestControllerOpts{DisableAuthorizationFailures: true})
+	assert, require := assert.New(t), require.New(t)
+	amId := "paum_1234567890"
+	tc := controller.NewTestController(t, &controller.TestControllerOpts{
+		DisableAuthorizationFailures: true,
+		DefaultAuthMethodId:          amId,
+		DefaultUsername:              "user",
+		DefaultPassword:              "passpass",
+	})
 	defer tc.Shutdown()
-	ctx := tc.Context()
 
 	client := tc.Client()
-	org := &scopes.Org{
-		Client: client,
-	}
+	tokens := authtokens.NewAuthTokenClient(client)
 
-	_, apiErr, err := org.ReadAuthToken(ctx, &authtokens.AuthToken{Id: authtoken.AuthTokenPrefix + "_doesntexis"})
-	assert.NoError(err)
+	_, apiErr, err := tokens.Read(tc.Context(), authtoken.AuthTokenPrefix+"_doesntexis")
+	require.NoError(err)
 	assert.NotNil(apiErr)
-	assert.EqualValues(apiErr.Status, http.StatusNotFound)
+	assert.EqualValues(http.StatusNotFound, apiErr.Status)
 
-	_, apiErr, err = org.ReadAuthToken(ctx, &authtokens.AuthToken{Id: "invalid id"})
-	assert.NoError(err)
+	_, apiErr, err = tokens.Read(tc.Context(), "invalid id")
+	require.NoError(err)
 	assert.NotNil(apiErr)
-	assert.EqualValues(apiErr.Status, http.StatusBadRequest)
+	assert.EqualValues(http.StatusForbidden, apiErr.Status)
 }
-*/
diff --git a/api/authtokens/authtokens.gen.go b/api/authtokens/authtokens.gen.go
index 0d987a814..eff7dd3b3 100644
--- a/api/authtokens/authtokens.gen.go
+++ b/api/authtokens/authtokens.gen.go
@@ -22,15 +22,15 @@ type AuthToken struct {
 	ExpirationTime          time.Time         `json:"expiration_time,omitempty"`
 }
 
-type authtokenClient struct {
+type authtokensClient struct {
 	client *api.Client
 }
 
-func NewAuthTokenClient(c *api.Client) *authtokenClient {
-	return &authtokenClient{client: c}
+func NewAuthTokensClient(c *api.Client) *authtokensClient {
+	return &authtokensClient{client: c}
 }
 
-func (c *authtokenClient) Read(ctx context.Context, authTokenId string, opt ...Option) (*AuthToken, *api.Error, error) {
+func (c *authtokensClient) Read(ctx context.Context, authTokenId string, opt ...Option) (*AuthToken, *api.Error, error) {
 	if authTokenId == "" {
 		return nil, nil, fmt.Errorf("empty authTokenId value passed into Read request")
 	}
@@ -60,7 +60,7 @@ func (c *authtokenClient) Read(ctx context.Context, authTokenId string, opt ...O
 	return target, apiErr, nil
 }
 
-func (c *authtokenClient) Delete(ctx context.Context, authTokenId string, opt ...Option) (bool, *api.Error, error) {
+func (c *authtokensClient) Delete(ctx context.Context, authTokenId string, opt ...Option) (bool, *api.Error, error) {
 	if authTokenId == "" {
 		return false, nil, fmt.Errorf("empty authTokenId value passed into Delete request")
 	}
@@ -93,7 +93,7 @@ func (c *authtokenClient) Delete(ctx context.Context, authTokenId string, opt ..
 	return target.Existed, apiErr, nil
 }
 
-func (c *authtokenClient) List(ctx context.Context, opt ...Option) ([]*AuthToken, *api.Error, error) {
+func (c *authtokensClient) List(ctx context.Context, opt ...Option) ([]*AuthToken, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
diff --git a/api/groups/group.gen.go b/api/groups/group.gen.go
index 0e2d0e23a..d32a8e437 100644
--- a/api/groups/group.gen.go
+++ b/api/groups/group.gen.go
@@ -26,15 +26,15 @@ type Group struct {
 	Members     []*Member         `json:"members,omitempty"`
 }
 
-type groupClient struct {
+type groupsClient struct {
 	client *api.Client
 }
 
-func NewGroupClient(c *api.Client) *groupClient {
-	return &groupClient{client: c}
+func NewGroupsClient(c *api.Client) *groupsClient {
+	return &groupsClient{client: c}
 }
 
-func (c *groupClient) Create(ctx context.Context, opt ...Option) (*Group, *api.Error, error) {
+func (c *groupsClient) Create(ctx context.Context, opt ...Option) (*Group, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -60,7 +60,7 @@ func (c *groupClient) Create(ctx context.Context, opt ...Option) (*Group, *api.E
 	return target, apiErr, nil
 }
 
-func (c *groupClient) Read(ctx context.Context, groupId string, opt ...Option) (*Group, *api.Error, error) {
+func (c *groupsClient) Read(ctx context.Context, groupId string, opt ...Option) (*Group, *api.Error, error) {
 	if groupId == "" {
 		return nil, nil, fmt.Errorf("empty groupId value passed into Read request")
 	}
@@ -90,7 +90,7 @@ func (c *groupClient) Read(ctx context.Context, groupId string, opt ...Option) (
 	return target, apiErr, nil
 }
 
-func (c *groupClient) Update(ctx context.Context, groupId string, version uint32, opt ...Option) (*Group, *api.Error, error) {
+func (c *groupsClient) Update(ctx context.Context, groupId string, version uint32, opt ...Option) (*Group, *api.Error, error) {
 	if groupId == "" {
 		return nil, nil, fmt.Errorf("empty groupId value passed into Update request")
 	}
@@ -137,7 +137,7 @@ func (c *groupClient) Update(ctx context.Context, groupId string, version uint32
 	return target, apiErr, nil
 }
 
-func (c *groupClient) Delete(ctx context.Context, groupId string, opt ...Option) (bool, *api.Error, error) {
+func (c *groupsClient) Delete(ctx context.Context, groupId string, opt ...Option) (bool, *api.Error, error) {
 	if groupId == "" {
 		return false, nil, fmt.Errorf("empty groupId value passed into Delete request")
 	}
@@ -170,7 +170,7 @@ func (c *groupClient) Delete(ctx context.Context, groupId string, opt ...Option)
 	return target.Existed, apiErr, nil
 }
 
-func (c *groupClient) List(ctx context.Context, opt ...Option) ([]*Group, *api.Error, error) {
+func (c *groupsClient) List(ctx context.Context, opt ...Option) ([]*Group, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -199,7 +199,7 @@ func (c *groupClient) List(ctx context.Context, opt ...Option) ([]*Group, *api.E
 	return target.Items, apiErr, nil
 }
 
-func (c *groupClient) AddMembers(ctx context.Context, groupId string, version uint32, memberIds []string, opt ...Option) (*Group, *api.Error, error) {
+func (c *groupsClient) AddMembers(ctx context.Context, groupId string, version uint32, memberIds []string, opt ...Option) (*Group, *api.Error, error) {
 	if groupId == "" {
 		return nil, nil, fmt.Errorf("empty groupId value passed into AddMembers request")
 	}
@@ -250,7 +250,7 @@ func (c *groupClient) AddMembers(ctx context.Context, groupId string, version ui
 	return target, apiErr, nil
 }
 
-func (c *groupClient) SetMembers(ctx context.Context, groupId string, version uint32, memberIds []string, opt ...Option) (*Group, *api.Error, error) {
+func (c *groupsClient) SetMembers(ctx context.Context, groupId string, version uint32, memberIds []string, opt ...Option) (*Group, *api.Error, error) {
 	if groupId == "" {
 		return nil, nil, fmt.Errorf("empty groupId value passed into SetMembers request")
 	}
@@ -304,7 +304,7 @@ func (c *groupClient) SetMembers(ctx context.Context, groupId string, version ui
 	return target, apiErr, nil
 }
 
-func (c *groupClient) RemoveMembers(ctx context.Context, groupId string, version uint32, memberIds []string, opt ...Option) (*Group, *api.Error, error) {
+func (c *groupsClient) RemoveMembers(ctx context.Context, groupId string, version uint32, memberIds []string, opt ...Option) (*Group, *api.Error, error) {
 	if groupId == "" {
 		return nil, nil, fmt.Errorf("empty groupId value passed into RemoveMembers request")
 	}
diff --git a/api/hosts/host.gen.go b/api/hosts/host.gen.go
index 5e2fbfa86..7f4190130 100644
--- a/api/hosts/host.gen.go
+++ b/api/hosts/host.gen.go
@@ -22,15 +22,15 @@ type Host struct {
 	Address     string            `json:"address,omitempty"`
 }
 
-type hostClient struct {
+type hostsClient struct {
 	client *api.Client
 }
 
-func NewHostClient(c *api.Client) *hostClient {
-	return &hostClient{client: c}
+func NewHostsClient(c *api.Client) *hostsClient {
+	return &hostsClient{client: c}
 }
 
-func (c *hostClient) Create(ctx context.Context, hostCatalogId string, opt ...Option) (*Host, *api.Error, error) {
+func (c *hostsClient) Create(ctx context.Context, hostCatalogId string, opt ...Option) (*Host, *api.Error, error) {
 	if hostCatalogId == "" {
 		return nil, nil, fmt.Errorf("empty hostCatalogId value passed into Create request")
 	}
@@ -60,7 +60,7 @@ func (c *hostClient) Create(ctx context.Context, hostCatalogId string, opt ...Op
 	return target, apiErr, nil
 }
 
-func (c *hostClient) Read(ctx context.Context, hostCatalogId string, hostId string, opt ...Option) (*Host, *api.Error, error) {
+func (c *hostsClient) Read(ctx context.Context, hostCatalogId string, hostId string, opt ...Option) (*Host, *api.Error, error) {
 	if hostCatalogId == "" {
 		return nil, nil, fmt.Errorf("empty hostCatalogId value passed into Read request")
 	}
@@ -94,7 +94,7 @@ func (c *hostClient) Read(ctx context.Context, hostCatalogId string, hostId stri
 	return target, apiErr, nil
 }
 
-func (c *hostClient) Update(ctx context.Context, hostCatalogId string, hostId string, version uint32, opt ...Option) (*Host, *api.Error, error) {
+func (c *hostsClient) Update(ctx context.Context, hostCatalogId string, hostId string, version uint32, opt ...Option) (*Host, *api.Error, error) {
 	if hostCatalogId == "" {
 		return nil, nil, fmt.Errorf("empty hostCatalogId value passed into Update request")
 	}
@@ -126,7 +126,7 @@ func (c *hostClient) Update(ctx context.Context, hostCatalogId string, hostId st
 	return target, apiErr, nil
 }
 
-func (c *hostClient) Delete(ctx context.Context, hostCatalogId string, hostId string, opt ...Option) (bool, *api.Error, error) {
+func (c *hostsClient) Delete(ctx context.Context, hostCatalogId string, hostId string, opt ...Option) (bool, *api.Error, error) {
 	if hostCatalogId == "" {
 		return false, nil, fmt.Errorf("empty hostCatalogId value passed into Delete request")
 	}
@@ -163,7 +163,7 @@ func (c *hostClient) Delete(ctx context.Context, hostCatalogId string, hostId st
 	return target.Existed, apiErr, nil
 }
 
-func (c *hostClient) List(ctx context.Context, hostCatalogId string, opt ...Option) ([]*Host, *api.Error, error) {
+func (c *hostsClient) List(ctx context.Context, hostCatalogId string, opt ...Option) ([]*Host, *api.Error, error) {
 	if hostCatalogId == "" {
 		return nil, nil, fmt.Errorf("empty hostCatalogId value passed into List request")
 	}
diff --git a/api/hosts/host_catalog.gen.go b/api/hosts/host_catalog.gen.go
index 863d3c898..c1f40ffad 100644
--- a/api/hosts/host_catalog.gen.go
+++ b/api/hosts/host_catalog.gen.go
@@ -22,15 +22,15 @@ type HostCatalog struct {
 	Attributes  map[string]interface{} `json:"attributes,omitempty"`
 }
 
-type hostcatalogClient struct {
+type hostcatalogsClient struct {
 	client *api.Client
 }
 
-func NewHostCatalogClient(c *api.Client) *hostcatalogClient {
-	return &hostcatalogClient{client: c}
+func NewHostCatalogsClient(c *api.Client) *hostcatalogsClient {
+	return &hostcatalogsClient{client: c}
 }
 
-func (c *hostcatalogClient) Create(ctx context.Context, opt ...Option) (*HostCatalog, *api.Error, error) {
+func (c *hostcatalogsClient) Create(ctx context.Context, opt ...Option) (*HostCatalog, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -56,7 +56,7 @@ func (c *hostcatalogClient) Create(ctx context.Context, opt ...Option) (*HostCat
 	return target, apiErr, nil
 }
 
-func (c *hostcatalogClient) Read(ctx context.Context, hostCatalogId string, opt ...Option) (*HostCatalog, *api.Error, error) {
+func (c *hostcatalogsClient) Read(ctx context.Context, hostCatalogId string, opt ...Option) (*HostCatalog, *api.Error, error) {
 	if hostCatalogId == "" {
 		return nil, nil, fmt.Errorf("empty hostCatalogId value passed into Read request")
 	}
@@ -86,7 +86,7 @@ func (c *hostcatalogClient) Read(ctx context.Context, hostCatalogId string, opt
 	return target, apiErr, nil
 }
 
-func (c *hostcatalogClient) Update(ctx context.Context, hostCatalogId string, version uint32, opt ...Option) (*HostCatalog, *api.Error, error) {
+func (c *hostcatalogsClient) Update(ctx context.Context, hostCatalogId string, version uint32, opt ...Option) (*HostCatalog, *api.Error, error) {
 	if hostCatalogId == "" {
 		return nil, nil, fmt.Errorf("empty hostCatalogId value passed into Update request")
 	}
@@ -115,7 +115,7 @@ func (c *hostcatalogClient) Update(ctx context.Context, hostCatalogId string, ve
 	return target, apiErr, nil
 }
 
-func (c *hostcatalogClient) Delete(ctx context.Context, hostCatalogId string, opt ...Option) (bool, *api.Error, error) {
+func (c *hostcatalogsClient) Delete(ctx context.Context, hostCatalogId string, opt ...Option) (bool, *api.Error, error) {
 	if hostCatalogId == "" {
 		return false, nil, fmt.Errorf("empty hostCatalogId value passed into Delete request")
 	}
@@ -148,7 +148,7 @@ func (c *hostcatalogClient) Delete(ctx context.Context, hostCatalogId string, op
 	return target.Existed, apiErr, nil
 }
 
-func (c *hostcatalogClient) List(ctx context.Context, opt ...Option) ([]*HostCatalog, *api.Error, error) {
+func (c *hostcatalogsClient) List(ctx context.Context, opt ...Option) ([]*HostCatalog, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
diff --git a/api/internal/genapi/templates.go b/api/internal/genapi/templates.go
index 6ce134e07..42fafc987 100644
--- a/api/internal/genapi/templates.go
+++ b/api/internal/genapi/templates.go
@@ -62,7 +62,7 @@ func fillTemplates() {
 	for _, in := range inputStructs {
 		outBuf := new(bytes.Buffer)
 		input := templateInput{
-			ClientName:     strings.ToLower(in.generatedStructure.name),
+			ClientName:     strings.ToLower(in.generatedStructure.name) + "s",
 			Name:           in.generatedStructure.name,
 			Package:        in.generatedStructure.pkg,
 			Fields:         in.generatedStructure.fields,
@@ -453,7 +453,7 @@ type {{ .ClientName }}Client struct {
 	client *api.Client
 }
 
-func New{{ .Name }}Client(c *api.Client) *{{ .ClientName }}Client {
+func New{{ .Name }}sClient(c *api.Client) *{{ .ClientName }}Client {
 	return &{{ .ClientName }}Client{ client: c }
 }
 `))
diff --git a/api/roles/role.gen.go b/api/roles/role.gen.go
index 6e4d4ef0b..5321b1d52 100644
--- a/api/roles/role.gen.go
+++ b/api/roles/role.gen.go
@@ -29,15 +29,15 @@ type Role struct {
 	Grants       []*Grant          `json:"grants,omitempty"`
 }
 
-type roleClient struct {
+type rolesClient struct {
 	client *api.Client
 }
 
-func NewRoleClient(c *api.Client) *roleClient {
-	return &roleClient{client: c}
+func NewRolesClient(c *api.Client) *rolesClient {
+	return &rolesClient{client: c}
 }
 
-func (c *roleClient) Create(ctx context.Context, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) Create(ctx context.Context, opt ...Option) (*Role, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -63,7 +63,7 @@ func (c *roleClient) Create(ctx context.Context, opt ...Option) (*Role, *api.Err
 	return target, apiErr, nil
 }
 
-func (c *roleClient) Read(ctx context.Context, roleId string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) Read(ctx context.Context, roleId string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into Read request")
 	}
@@ -93,7 +93,7 @@ func (c *roleClient) Read(ctx context.Context, roleId string, opt ...Option) (*R
 	return target, apiErr, nil
 }
 
-func (c *roleClient) Update(ctx context.Context, roleId string, version uint32, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) Update(ctx context.Context, roleId string, version uint32, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into Update request")
 	}
@@ -140,7 +140,7 @@ func (c *roleClient) Update(ctx context.Context, roleId string, version uint32,
 	return target, apiErr, nil
 }
 
-func (c *roleClient) Delete(ctx context.Context, roleId string, opt ...Option) (bool, *api.Error, error) {
+func (c *rolesClient) Delete(ctx context.Context, roleId string, opt ...Option) (bool, *api.Error, error) {
 	if roleId == "" {
 		return false, nil, fmt.Errorf("empty roleId value passed into Delete request")
 	}
@@ -173,7 +173,7 @@ func (c *roleClient) Delete(ctx context.Context, roleId string, opt ...Option) (
 	return target.Existed, apiErr, nil
 }
 
-func (c *roleClient) List(ctx context.Context, opt ...Option) ([]*Role, *api.Error, error) {
+func (c *rolesClient) List(ctx context.Context, opt ...Option) ([]*Role, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -202,7 +202,7 @@ func (c *roleClient) List(ctx context.Context, opt ...Option) ([]*Role, *api.Err
 	return target.Items, apiErr, nil
 }
 
-func (c *roleClient) AddGrants(ctx context.Context, roleId string, version uint32, grantStrings []string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) AddGrants(ctx context.Context, roleId string, version uint32, grantStrings []string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into AddGrants request")
 	}
@@ -253,7 +253,7 @@ func (c *roleClient) AddGrants(ctx context.Context, roleId string, version uint3
 	return target, apiErr, nil
 }
 
-func (c *roleClient) AddPrincipals(ctx context.Context, roleId string, version uint32, principalIds []string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) AddPrincipals(ctx context.Context, roleId string, version uint32, principalIds []string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into AddPrincipals request")
 	}
@@ -304,7 +304,7 @@ func (c *roleClient) AddPrincipals(ctx context.Context, roleId string, version u
 	return target, apiErr, nil
 }
 
-func (c *roleClient) SetGrants(ctx context.Context, roleId string, version uint32, grantStrings []string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) SetGrants(ctx context.Context, roleId string, version uint32, grantStrings []string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into SetGrants request")
 	}
@@ -358,7 +358,7 @@ func (c *roleClient) SetGrants(ctx context.Context, roleId string, version uint3
 	return target, apiErr, nil
 }
 
-func (c *roleClient) SetPrincipals(ctx context.Context, roleId string, version uint32, principalIds []string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) SetPrincipals(ctx context.Context, roleId string, version uint32, principalIds []string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into SetPrincipals request")
 	}
@@ -412,7 +412,7 @@ func (c *roleClient) SetPrincipals(ctx context.Context, roleId string, version u
 	return target, apiErr, nil
 }
 
-func (c *roleClient) RemoveGrants(ctx context.Context, roleId string, version uint32, grantStrings []string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) RemoveGrants(ctx context.Context, roleId string, version uint32, grantStrings []string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into RemoveGrants request")
 	}
@@ -463,7 +463,7 @@ func (c *roleClient) RemoveGrants(ctx context.Context, roleId string, version ui
 	return target, apiErr, nil
 }
 
-func (c *roleClient) RemovePrincipals(ctx context.Context, roleId string, version uint32, principalIds []string, opt ...Option) (*Role, *api.Error, error) {
+func (c *rolesClient) RemovePrincipals(ctx context.Context, roleId string, version uint32, principalIds []string, opt ...Option) (*Role, *api.Error, error) {
 	if roleId == "" {
 		return nil, nil, fmt.Errorf("empty roleId value passed into RemovePrincipals request")
 	}
diff --git a/api/scopes/scope.gen.go b/api/scopes/scope.gen.go
index e4f00a039..17046ff72 100644
--- a/api/scopes/scope.gen.go
+++ b/api/scopes/scope.gen.go
@@ -23,15 +23,15 @@ type Scope struct {
 	Version     uint32     `json:"version,omitempty"`
 }
 
-type scopeClient struct {
+type scopesClient struct {
 	client *api.Client
 }
 
-func NewScopeClient(c *api.Client) *scopeClient {
-	return &scopeClient{client: c}
+func NewScopesClient(c *api.Client) *scopesClient {
+	return &scopesClient{client: c}
 }
 
-func (c *scopeClient) Create(ctx context.Context, opt ...Option) (*Scope, *api.Error, error) {
+func (c *scopesClient) Create(ctx context.Context, opt ...Option) (*Scope, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -57,7 +57,7 @@ func (c *scopeClient) Create(ctx context.Context, opt ...Option) (*Scope, *api.E
 	return target, apiErr, nil
 }
 
-func (c *scopeClient) Read(ctx context.Context, scopeId string, opt ...Option) (*Scope, *api.Error, error) {
+func (c *scopesClient) Read(ctx context.Context, scopeId string, opt ...Option) (*Scope, *api.Error, error) {
 	if scopeId == "" {
 		return nil, nil, fmt.Errorf("empty scopeId value passed into Read request")
 	}
@@ -87,7 +87,7 @@ func (c *scopeClient) Read(ctx context.Context, scopeId string, opt ...Option) (
 	return target, apiErr, nil
 }
 
-func (c *scopeClient) Update(ctx context.Context, scopeId string, version uint32, opt ...Option) (*Scope, *api.Error, error) {
+func (c *scopesClient) Update(ctx context.Context, scopeId string, version uint32, opt ...Option) (*Scope, *api.Error, error) {
 	if scopeId == "" {
 		return nil, nil, fmt.Errorf("empty scopeId value passed into Update request")
 	}
@@ -134,7 +134,7 @@ func (c *scopeClient) Update(ctx context.Context, scopeId string, version uint32
 	return target, apiErr, nil
 }
 
-func (c *scopeClient) Delete(ctx context.Context, scopeId string, opt ...Option) (bool, *api.Error, error) {
+func (c *scopesClient) Delete(ctx context.Context, scopeId string, opt ...Option) (bool, *api.Error, error) {
 	if scopeId == "" {
 		return false, nil, fmt.Errorf("empty scopeId value passed into Delete request")
 	}
@@ -167,7 +167,7 @@ func (c *scopeClient) Delete(ctx context.Context, scopeId string, opt ...Option)
 	return target.Existed, apiErr, nil
 }
 
-func (c *scopeClient) List(ctx context.Context, opt ...Option) ([]*Scope, *api.Error, error) {
+func (c *scopesClient) List(ctx context.Context, opt ...Option) ([]*Scope, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
diff --git a/api/users/user.gen.go b/api/users/user.gen.go
index 1f4405926..cd2a1fe31 100644
--- a/api/users/user.gen.go
+++ b/api/users/user.gen.go
@@ -24,15 +24,15 @@ type User struct {
 	Version     uint32            `json:"version,omitempty"`
 }
 
-type userClient struct {
+type usersClient struct {
 	client *api.Client
 }
 
-func NewUserClient(c *api.Client) *userClient {
-	return &userClient{client: c}
+func NewUsersClient(c *api.Client) *usersClient {
+	return &usersClient{client: c}
 }
 
-func (c *userClient) Create(ctx context.Context, opt ...Option) (*User, *api.Error, error) {
+func (c *usersClient) Create(ctx context.Context, opt ...Option) (*User, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
@@ -58,7 +58,7 @@ func (c *userClient) Create(ctx context.Context, opt ...Option) (*User, *api.Err
 	return target, apiErr, nil
 }
 
-func (c *userClient) Read(ctx context.Context, userId string, opt ...Option) (*User, *api.Error, error) {
+func (c *usersClient) Read(ctx context.Context, userId string, opt ...Option) (*User, *api.Error, error) {
 	if userId == "" {
 		return nil, nil, fmt.Errorf("empty userId value passed into Read request")
 	}
@@ -88,7 +88,7 @@ func (c *userClient) Read(ctx context.Context, userId string, opt ...Option) (*U
 	return target, apiErr, nil
 }
 
-func (c *userClient) Update(ctx context.Context, userId string, version uint32, opt ...Option) (*User, *api.Error, error) {
+func (c *usersClient) Update(ctx context.Context, userId string, version uint32, opt ...Option) (*User, *api.Error, error) {
 	if userId == "" {
 		return nil, nil, fmt.Errorf("empty userId value passed into Update request")
 	}
@@ -135,7 +135,7 @@ func (c *userClient) Update(ctx context.Context, userId string, version uint32,
 	return target, apiErr, nil
 }
 
-func (c *userClient) Delete(ctx context.Context, userId string, opt ...Option) (bool, *api.Error, error) {
+func (c *usersClient) Delete(ctx context.Context, userId string, opt ...Option) (bool, *api.Error, error) {
 	if userId == "" {
 		return false, nil, fmt.Errorf("empty userId value passed into Delete request")
 	}
@@ -168,7 +168,7 @@ func (c *userClient) Delete(ctx context.Context, userId string, opt ...Option) (
 	return target.Existed, apiErr, nil
 }
 
-func (c *userClient) List(ctx context.Context, opt ...Option) ([]*User, *api.Error, error) {
+func (c *usersClient) List(ctx context.Context, opt ...Option) ([]*User, *api.Error, error) {
 	if c.client == nil {
 		return nil, nil, fmt.Errorf("nil client")
 	}
diff --git a/go.mod b/go.mod
index 58914dd6c..61e33ccbd 100644
--- a/go.mod
+++ b/go.mod
@@ -3,9 +3,6 @@ module github.com/hashicorp/watchtower
 go 1.13
 
 require (
-	github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38
-	github.com/alecthomas/colour v0.1.0 // indirect
-	github.com/alecthomas/repr v0.0.0-20200325044227-4184120f674c // indirect
 	github.com/armon/go-metrics v0.3.3
 	github.com/bufbuild/buf v0.20.4
 	github.com/fatih/color v1.9.0
@@ -42,7 +39,6 @@ require (
 	github.com/lib/pq v1.7.1
 	github.com/mattn/go-colorable v0.1.7
 	github.com/mitchellh/cli v1.1.1
-	github.com/mitchellh/go-homedir v1.1.0
 	github.com/mitchellh/go-wordwrap v1.0.0
 	github.com/mitchellh/gox v1.0.1
 	github.com/mitchellh/mapstructure v1.3.3
@@ -53,14 +49,13 @@ require (
 	github.com/posener/complete v1.2.3
 	github.com/ryanuber/columnize v2.1.0+incompatible
 	github.com/ryanuber/go-glob v1.0.0
-	github.com/sergi/go-diff v1.0.0 // indirect
 	github.com/stretchr/testify v1.6.1
 	github.com/zalando/go-keyring v0.1.0
-	go.uber.org/atomic v1.6.0
 	golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899
 	golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e
 	golang.org/x/tools v0.0.0-20200722181740-bd1e9de8d890
 	google.golang.org/genproto v0.0.0-20200722002428-88e341933a54
 	google.golang.org/grpc v1.30.0
 	google.golang.org/protobuf v1.25.0
+	gotest.tools v2.2.0+incompatible
 )
diff --git a/go.sum b/go.sum
index 163e57e40..cdbe6e0da 100644
--- a/go.sum
+++ b/go.sum
@@ -123,12 +123,6 @@ github.com/Shopify/toxiproxy v2.1.4+incompatible/go.mod h1:OXgGpZ6Cli1/URJOF1DMx
 github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d h1:G0m3OIz70MZUWq3EgK3CesDbo8upS2Vm9/P3FtgI+Jk=
 github.com/StackExchange/wmi v0.0.0-20190523213315-cbe66965904d/go.mod h1:3eOhrUMpNV+6aFIbp5/iudMxNCF27Vw2OZgy4xEx0Fg=
 github.com/abdullin/seq v0.0.0-20160510034733-d5467c17e7af/go.mod h1:5Jv4cbFiHJMsVxt52+i0Ha45fjshj6wxYr1r19tB9bw=
-github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38 h1:smF2tmSOzy2Mm+0dGI2AIUHY+w0BUc+4tn40djz7+6U=
-github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
-github.com/alecthomas/colour v0.1.0 h1:nOE9rJm6dsZ66RGWYSFrXw461ZIt9A6+nHgL7FRrDUk=
-github.com/alecthomas/colour v0.1.0/go.mod h1:QO9JBoKquHd+jz9nshCh40fOfO+JzsoXy8qTHF68zU0=
-github.com/alecthomas/repr v0.0.0-20200325044227-4184120f674c h1:MVVbswUlqicyj8P/JljoocA7AyCo62gzD0O7jfvrhtE=
-github.com/alecthomas/repr v0.0.0-20200325044227-4184120f674c/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -1231,8 +1225,6 @@ github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdh
 github.com/sean-/conswriter v0.0.0-20180208195008-f5ae3917a627/go.mod h1:7zjs06qF79/FKAJpBvFx3P8Ww4UTIMAe+lpNXDHziac=
 github.com/sean-/pager v0.0.0-20180208200047-666be9bf53b5/go.mod h1:BeybITEsBEg6qbIiqJ6/Bqeq25bCLbL7YFmpaFfJDuM=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
 github.com/shirou/gopsutil v2.20.6-0.20200630091542-01afd763e6c0+incompatible h1:IYOqH6sML3rQGNVEQ5foLtpDt4TeW8PIUBuI9f8itkI=
 github.com/shirou/gopsutil v2.20.6-0.20200630091542-01afd763e6c0+incompatible/go.mod h1:5b4v6he4MtMOwMlS0TUMTu2PcXUg8+E1lC7eC3UO/RA=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24 h1:pntxY8Ary0t43dCZ5dqY4YTJCObLY1kIXl0uzMv+7DE=
diff --git a/internal/auth/auth.go b/internal/auth/auth.go
index 98efdf6b9..d5074d8f1 100644
--- a/internal/auth/auth.go
+++ b/internal/auth/auth.go
@@ -298,6 +298,11 @@ func (v *verifier) parseAuthParams() error {
 			return fmt.Errorf("parse auth parameters: unexpected empty segment")
 		}
 
+		// If the segment contains whitespace, it's not valid
+		if fields := strings.Fields(segment); len(fields) != 1 || fields[0] != segment {
+			return fmt.Errorf("parse auth params: segment %q contains whitespace", segment)
+		}
+
 		// Collections don't contain underscores; every resource ID does.
 		segmentIsCollection := !strings.Contains(segment, "_")
 
diff --git a/internal/servers/controller/handler_ui_test.go b/internal/servers/controller/handler_ui_test.go
index fb0218656..5bec9443f 100644
--- a/internal/servers/controller/handler_ui_test.go
+++ b/internal/servers/controller/handler_ui_test.go
@@ -11,7 +11,7 @@ import (
 	"path/filepath"
 	"testing"
 
-	"github.com/alecthomas/assert"
+	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
diff --git a/internal/servers/controller/testing.go b/internal/servers/controller/testing.go
index 9feea8a30..02d4caab1 100644
--- a/internal/servers/controller/testing.go
+++ b/internal/servers/controller/testing.go
@@ -114,6 +114,9 @@ type TestControllerOpts struct {
 	// in the normal config.
 	DefaultOrgId string
 
+	// DefaultAuthMethodId is the default auth method ID to use, if set.
+	DefaultAuthMethodId string
+
 	// DefaultUsername is the username used when creating the default account.
 	DefaultUsername string
 
@@ -168,7 +171,9 @@ func NewTestController(t *testing.T, opts *TestControllerOpts) *TestController {
 	if opts.DefaultOrgId != "" {
 		tc.b.DefaultOrgId = opts.DefaultOrgId
 	}
-
+	if opts.DefaultAuthMethodId != "" {
+		tc.b.DevAuthMethodId = opts.DefaultAuthMethodId
+	}
 	if opts.DefaultUsername != "" {
 		tc.b.DevUsername = opts.DefaultUsername
 	}