Confused about libraries vs models

[eluser]mddd[/eluser]

Sounds like models should me more application-specific, and libraries more generic, am I right?

Yes.

But what happens with things like say, an auth system? It should be reusable, it must access the database, and probably it needs to handle sessions too.

Unless your system is very specific to your application, that could (should) be a library. The tasks that library must perfom will probably be the same in other applications. Settings can be applied through configuration. Like accessing the database: the database access is set in configuration, so the library will function fine on another site with different database settings.

In fact, there are several auth libraries in use that you can take a look at. You wouldn't have to write your own. And the same goes for many other common tasks.