Don't clobber auth when testSynclet pages

Because we were just setting `pi = data`, we were throwing out the `auth` object
and making it impossible to do a second run. This merges the `config` object
more like in the real code.

We might have to do this on the sandboxed synclets too, but leaving it alone
until I find a test case.