mock get_password before authentication is established

since get_password is referenced in RestApiAuth.__init__(),
function patches don't mock the DAO early enough
avoid calling the DAO when running on localhost

Also needed to avoid mocking the DAO for all resource tests