stay with the _get_auth() function for test's sake

so that we can patch this function in the storage-only tests.