While a new member joins a replica set its state is RECOVERING, and auth fails against it until it has replicated the primary's auth schema. PyMongo's database.authenticate() prefers to auth against the primary, but if you call authenticate immediately, before the primary is discovered:

client = MongoClient(hosts, replicaSet='rs')
client.db.authenticate(user, passwd)

... then PyMongo may discover the recovering member and attempt auth against it, instead.

authenticate() should select only secondaries, if no primary is available. It should never use a recovering member.