Rework server.auth(). Closes #1287