Add ability to skip auth in specific modes

The configurator knows the general active mode and exposes a function
to check for it.
It's also the only place to instantiate Auth instances.

Auth instances can now be configured with an array of `skipModes` -
modes where the authentication routine is circumvented.

The configurator passes the mode function to the Auth instance, so that
it can check if authentication is required or not.

Closes #458