diff --git a/lib/WebGUI/Auth.pm b/lib/WebGUI/Auth.pm
index 590f283e5..7aa5a8927 100644
--- a/lib/WebGUI/Auth.pm
+++ b/lib/WebGUI/Auth.pm
@@ -15,6 +15,7 @@ package WebGUI::Auth;
 =cut
 
 use strict qw(subs vars);
+use Scalar::Util qw( blessed );
 use WebGUI::International;
 use WebGUI::Asset::Template;
 use WebGUI::User;
@@ -1009,15 +1010,16 @@ sub logout {
 
 #-------------------------------------------------------------------
 
-=head2 new ( session, [ userId ] )
+=head2 new ( session, [ user|userId ] )
 
 Constructor.
 
 =head3 session
 
-=head3 userId
+=head3 user|userId
 
-userId for the user requesting authentication.  This defaults to $self->session->user->userId
+A WebGUI::User object, or userId for the user requesting authentication.
+This defaults to $self->session->user->userId
 
 =cut
 
@@ -1025,8 +1027,17 @@ sub new {
 	my $class = shift;
 	my $self = bless {}, $class;
 	$self->{_session} = shift;
-	my $userId = shift || $self->{_session}->user->userId;
-	$self->{user} = WebGUI::User->new($self->{_session}, $userId);
+
+        if ( blessed $_[0] && $_[0]->isa('WebGUI::User') ) {
+            $self->{user} = shift;
+        }
+        elsif ( my $userId = shift ) {
+            $self->{user} = WebGUI::User->new($self->{_session}, $userId);
+        }
+        else {
+            $self->{user} = $self->session->user;
+        }
+
 	$self->{error} = "";
 	$self->{profile} = ();
 
diff --git a/t/Auth/WebGUI.t b/t/Auth/WebGUI.t
new file mode 100644
index 000000000..335f7fabd
--- /dev/null
+++ b/t/Auth/WebGUI.t
@@ -0,0 +1,72 @@
+# vim:syntax=perl
+#-------------------------------------------------------------------
+# WebGUI is Copyright 2001-2009 Plain Black Corporation.
+#-------------------------------------------------------------------
+# Please read the legal notices (docs/legal.txt) and the license
+# (docs/license.txt) that came with this distribution before using
+# this software.
+#------------------------------------------------------------------
+# http://www.plainblack.com                     info@plainblack.com
+#------------------------------------------------------------------
+
+# Test the WebGUI Auth module
+# 
+#
+
+use FindBin;
+use strict;
+use lib "$FindBin::Bin/lib";
+use Test::More;
+use Test::Exception;
+use Test::Deep;
+use WebGUI::Test; # Must use this before any other WebGUI modules
+use WebGUI::Session;
+use WebGUI::Auth::WebGUI;
+
+#----------------------------------------------------------------------------
+# Init
+my $session         = WebGUI::Test->session;
+
+my $user            = WebGUI::User->create( $session );
+addToCleanup( $user );
+
+#----------------------------------------------------------------------------
+# Test instance
+
+my $auth    = WebGUI::Auth::WebGUI->new( $session, $user );
+is( $auth->user, $user, 'Auth accepts user object' );
+
+$auth       = WebGUI::Auth::WebGUI->new( $session, $user->userId );
+is( $auth->userId, $user->userId, 'Auth accepts userId' );
+
+$session->user({ user => $user });
+$auth       = WebGUI::Auth::WebGUI->new( $session );
+is( $auth->user, $user, 'Auth defaults to current user' );
+
+#----------------------------------------------------------------------------
+# Test get, delete, and update
+lives_ok( sub { $auth->update( test1 => "one" ) }, 'update accepts list of key/value pairs' );
+lives_ok( sub { $auth->update({ test2 => "two" }) }, 'update accepts single hashref' );
+
+is( $auth->get('test1'), "one", 'get returns scalar with argument' );
+cmp_deeply(
+    $auth->get,
+    superhashof( {
+        test1       => "one",
+        test2       => "two",
+    } ),
+    "get without arguments returns hashref",
+);
+
+lives_ok( sub { $auth->delete( "test1" ) }, 'delete a single key' );
+ok( !$auth->get('test1'), "delete actually deletes" );
+lives_ok( sub { $auth->delete }, 'delete all keys' );
+ok( !$auth->get('test2'), "deleted all" );
+
+#----------------------------------------------------------------------------
+# 
+
+
+done_testing;
+
+#vim:ft=perl