state/apiserver/common: refactor AuthAlways

This branch prepares for an upcoming change to make AuthAlways more strict by splitting `AuthAlways(true/false)` into two helpers, `AuthAlways` and `AuthNever` which take no arguments.

As the value passed to `AuthAlways`was a constant in all but one case this has made the code easier to read in the common case.