'auth' can be either a callable or class instance.

Closes #248.