application: refactor auth handling

try all auth systems to find a 200 (authorised) response, rather than only trying the first one that doesn't fail - also, do this before attempting to connect to the database.