state/apiserver/common: AuthAlways requires a valid tag

AuthAlways would previously authenticate any string, even if it was not a valid tag.

This made it a poor mock, not to mention a potential security risk.

This PR requires AuthAlways to validate the tag it is passed and will only return true if the tag is valid. This prepares for latter changes which will alter the signature of common.AuthFunc to require a tag, not a string.