auth should not hold mutexes while doing DB operations

This may cause operations to be blocked on database and/or global locks, but not report this as time spent acquiring locks. In addition, this means that timeouts may not be honored.