Factor out authentication into its own module

Just to make it easier to read and more testable.

The only functional change I know of is bumping the `X-Ops-Version` header to 11.6.x.