state/apiserver/common: refactor AuthAlways

This branch prepares for an upcoming change to make AuthAlways more strict by splitting `AuthAlways(true/false)` into two helpers, `AuthAlways` and `AuthNever` which take no arguments.

As the value passed to `AuthAlways`was a constant in all but one case this has made the code easier to read in the common case.
Actually no. I can't change that because AuthAlways/AuthNever aren't implementations of common.AuthFunc, they are factories that return common.AuthFunc implementations.