diff --git a/assets/scripts/app/app.coffee b/assets/scripts/app/app.coffee
index 8aaf0ba5..f5d68548 100644
--- a/assets/scripts/app/app.coffee
+++ b/assets/scripts/app/app.coffee
@@ -40,7 +40,7 @@ Travis.reopen
       @get('auth').storeAfterSignInPath(path)
 
     autoSignIn: (path) ->
-      @get('auth').autoSignIn(path)
+      @get('auth').autoSignIn()
 
     signIn: ->
       @get('auth').signIn()
diff --git a/assets/scripts/app/auth.coffee b/assets/scripts/app/auth.coffee
index c79efcf5..0be5b826 100644
--- a/assets/scripts/app/auth.coffee
+++ b/assets/scripts/app/auth.coffee
@@ -1,91 +1,63 @@
 @Travis.Auth = Ember.Object.extend
-  iframe: $('<iframe id="auth-frame" />').hide()
-  timeout: 30000 # api has a lower timeout for opening a popup
-  state: 'signed-out'
+  state:        "signed-out"
   receivingEnd: "#{location.protocol}//#{location.host}"
 
   init: ->
-    @iframe.appendTo('body')
     window.addEventListener('message', (e) => @receiveMessage(e))
 
-  accessToken: (->
-    Travis.sessionStorage.getItem('travis.token')
-  ).property()
-
-  # if the user is in the session storage, we're using it. if we have a flag
-  # for auto signin then we're trying to sign in.
-  autoSignIn: (path) ->
-    console.log 'autoSignIn'
-    global  = Travis.storage.getItem('travis.user')
-    session = Travis.sessionStorage.getItem('travis.user')
-    user    = session || global
-    if @validateUser(user)
-      Travis.storage.setItem('travis.user', user) unless global
-      data = JSON.parse(user)
-      data = { user: data } unless data.user?
-      @setData(data)
-    else if Travis.storage.getItem('travis.auto_signin')
-      console.log 'travis.auto_signin', Travis.storage.getItem('travis.auto_signin')
-      Travis.storage.setItem('travis.auto_signin', false)
-      @signIn()
-
-  validateUser: (user) ->
-    return false unless typeof user == 'string'
-    user = JSON.parse(user)
-    user.id && user.login && user.token
-
-  # try signing in, but check later in case we have a timeout
-  signIn: () ->
-    console.log 'set state, signing-in'
-    @set('state', 'signing-in')
-    @trySignIn()
-    Ember.run.later(this, @checkSignIn.bind(this), @timeout)
-
   signOut: ->
-    Travis.storage.removeItem('travis.auto_signin')
     Travis.storage.removeItem('travis.locale')
     Travis.storage.removeItem('travis.user')
     Travis.storage.removeItem('travis.token')
     Travis.sessionStorage.clear()
     Travis.setLocale Travis.default_locale
-    @setData()
+    @set('state', 'signed-out')
+    @set('user', undefined)
 
-  trySignIn: ->
-    console.log 'trySignIn', "#{@endpoint}/auth/post_message?origin=#{@receivingEnd}"
-    @iframe.attr('src', "#{@endpoint}/auth/post_message?origin=#{@receivingEnd}")
+  signIn: ->
+    @set('state', 'signing-in')
+    url = "#{@endpoint}/auth/post_message?origin=#{@receivingEnd}"
+    $('<iframe id="auth-frame" />').hide().appendTo('body').attr('src', url)
 
-  checkSignIn: ->
-    @forceSignIn() if @get('state') == 'signing-in'
+  autoSignIn: ->
+    data = @userDataFrom(Travis.sessionStorage) || @userDataFrom(Travis.storage)
+    @setData(data) if data
 
-  forceSignIn: ->
-    console.log 'forceSignIn'
-    Travis.storage.setItem('travis.auto_signin', 'true')
-    window.location = "#{@endpoint}/auth/handshake?redirect_uri=#{location}"
+  userDataFrom: (storage) ->
+    user  = JSON.parse storage.getItem('travis.user')
+    user  = user.user if user?.user
+    token = storage.getItem('travis.token')
+    if user && token && @validateUser(user)
+      { user: user, token: token }
+    else
+      storage.removeItem('travis.user')
+      storage.removeItem('travis.token')
+      null
+
+  validateUser: (user) ->
+    @validateHas('id', user) && @validateHas('login', user) #&& @validateHas('token', user)
+
+  validateHas: (field, user) ->
+    if user[field]
+      true
+    else
+      console.log("discarding user data, lacks #{field}")
+      false
 
-  # TODO should have clearData() to clean this up
   setData: (data) ->
-    data = JSON.parse(data) if typeof data == 'string'
-    @storeToken(data?.token)
-    user = @storeUser(data.user) if data?.user
-    @set('state', if user then 'signed-in' else 'signed-out')
-    @set('user',  if user then user else undefined)
-    @afterSignIn(data.user) if data?.user
-
-  afterSignIn: (user) ->
-    Travis.setLocale user.locale || Travis.default_locale
-    Travis.trigger('user:signed_in', user)
+    @storeData(data, Travis.sessionStorage)
+    @storeData(data, Travis.storage) unless @userDataFrom(Travis.storage)
+    @set('user', @loadUser(data.user))
+    @set('state', 'signed-in')
+    Travis.setLocale(data.user.locale || Travis.default_locale)
+    Travis.trigger('user:signed_in', data.user)
     @get('app.router').send('afterSignIn', @readAfterSignInPath())
 
-  storeToken: (token) ->
-    token = token || Travis.storage.getItem('travis.token')
-    if token
-      Travis.storage.setItem('travis.token', token)
-      Travis.sessionStorage.setItem('travis.token', token)
-      @notifyPropertyChange('accessToken')
+  storeData: (data, storage) ->
+    storage.setItem('travis.token', data.token)
+    storage.setItem('travis.user', JSON.stringify(data.user))
 
-  storeUser: (user) ->
-    Travis.storage.setItem('travis.auto_signin', 'true')
-    Travis.sessionStorage.setItem('travis.user', JSON.stringify(user))
+  loadUser: (user) ->
     @app.store.load(Travis.User, user)
     user = @app.store.find(Travis.User, user.id)
     user.get('permissions')
@@ -102,13 +74,10 @@
   receiveMessage: (event) ->
     if event.origin == @expectedOrigin()
       if event.data == 'redirect'
-        @forceSignIn()
+        window.location = "#{@endpoint}/auth/handshake?redirect_uri=#{location}"
       else if event.data.user?
         event.data.user.token = event.data.travis_token if event.data.travis_token
         @setData(event.data)
-        console.log("signed in as #{event.data.user.login}")
-    else
-      console.log("unexpected message #{event.origin}: #{event.data}")
 
   expectedOrigin: ->
     if @endpoint[0] == '/' then @receivingEnd else @endpoint
diff --git a/lib/travis/assets.rb b/lib/travis/assets.rb
index f5e5b8a9..b37412c9 100644
--- a/lib/travis/assets.rb
+++ b/lib/travis/assets.rb
@@ -17,12 +17,16 @@ module Travis
       @env = ENV['ENV']
     end
 
+    def staging?
+      ENV['API_ENDPOINT'] =~ /staging/ unless development?
+    end
+
     def production?
-      env == 'production'
+      !staging? and !development?
     end
 
     def development?
-      !production?
+      env != 'production'
     end
 
     def vendor_order