prevent auth thread startup block race.

in cases where all the auth threads (in an auth) are shutting down and a new listener
is wanting to be auth'd, it was possible that all threads would get their handles
null'd but the refcount would not drop until released. This elevated count could stop
a new listener from starting a fresh auth thread leaving a stuck client waiting to
get processed when another came in.

this commit means the lock is not dropped within the loop, but is kept until the
auth release is done (dropping the refcount).