don't get the dsn for the auth realm until we really need it

 * This also works around an issue where we can't get the dsn out of a
   schema that was connected via envvars (DBI_DSN, DBI_USER, DBI_PASS).