Actually use the handler that has auth installed

Master installs auth in front of other handlers,
but code that uses the master was not giving
this handler to the http servers.
Fix test, now that /_whoami sits behind auth.