Separated withAuthDomain from internalWithAuthDomain to allow authentication with a known AuthDomain, so that it's easier to construct handler wrappers. Extracted wrapDataSource to simplify creation of AuthDomain objects. Updated tests and docs.