Remove code-duplication around building AuthActions

The AuthActions only differ on what criteria they have for forcing the user to sign-in, so can remove a bit of repetition.
That's clearer - I'd be tempted to write the intent in a comment too.