Move ServerAuth out of Server()

We want to do auth after we've correctly set up the connection (by
e.g. exporting objects), otherwise there can be races where the
client starts sending requests before we've yet exported some
object.