auth: make internal AuthUser methods private

These methods are never invoked from outside AuthUser; make this
explicit in the code.

Also remove '_instance' member, which is not referenced anywhere else
in the code.