`onAuth()` now returns a dispose method (equivalent to `offAuth()`)