Respect auth source when matching actions

We must use the source that performed the authentication when matching
the actions such as "set role" and "set access duration".