http://docs.mongodb.org/manual/reference/local-database/

"When running with authentication (i.e. auth), authenticating against the local database is equivalent to authenticating against the admin database. This authentication gives access to all databases."

This no longer true with the new authentication model. Unless the user is using old style authentication