Remove code-duplication around building AuthActions

The AuthActions only differ on what criteria they have for forcing the user to sign-in, so can remove a bit of repetition.
I don't find these easy to comprehend - is it worth rewriting these as pattern matchers still?