add Database.auth, fix server-side ObjectID fetching