Metrics uses CachingAuthenticator

This should've been there in the beginning itself since each tenant is authenticated every minute.
Non-blocking nitpick: in zii parlance, instances *provide* interfaces, classes *implement* them; so I think this matcher should be `Provides`. Definitely shouldn't block this PR: can be a different ticket.