If there was a failure processing 'authdef' and the code went to cleanup
before the setting to source->auth, then it'd be leaked.