Move authentication storage default

This makes it behave better with the builder - if no `storage` option is set by the user, the default is still fetched from the sm by the builder.

Also means the config is clearer to end users.

No bc breaks.