Make auth APIs use IEnumerable instead of IList.

RE: #69
Yes, enumeration is the primary scenario. In one case we were checking Count == 0, but that's the same as !foo.Any().