Remove code-duplication around building AuthActions

The AuthActions only differ on what criteria they have for forcing the user to sign-in, so can remove a bit of repetition.
This isn't quite right. For LoginAuthAction, if a valid identity exists but has expired then we do not present a valid identity to the block (we don't assume that all blocks will check isValid, we simply say there is no use if it isn't valid).