Make auth APIs use IEnumerable instead of IList.

RE: #69
I agree that APIs should "take in" the minimal requirement, e.g. `IEnumerable<T>`. But when an API returns something, it is often best to return the "strongest" interface - e.g. `IList<T>` or `IReadOnlyList<T>`. Returning `IEnumerable<T>` could make this API more difficult to use because you pretty much need to use LINQ to do anything useful with it.

Is it true for these changed API return types that the only logical thing to do is a `foreach()` or similar? No one needs the `Count` or to be able to index?

(BTW we may have discussed this before and I may have merely forgotten :smile: )