fix broken /auth/merge endpoint

the `auth.account` field wasn't being set before saving the auth, so they were
getting pushed into Never Bever Land.