auth: make internal AuthUser methods private These methods are never invoked from outside AuthUser; make this explicit in the code. Also remove '_instance' member, which is not referenced anywhere else in the code.