Fix auth::match to handle multiple sources