Tweak AuthAction creation to be a little more explicit

Also tweak comments to be explicit about when the user will be forced
to reauthenticate.