Auth should probably set the "authSource" to match "db_name"

[johnoliver]

By default unless an authSource is defined it will auth against "admin". Encouraging apps to use admin db accounts as their application user is not great, and also the fact that it did not authenticate against the user of the db was unexpected and took some debugging to find.

In my opinion if no authSource is provided we should set it to the db the user is using, provided via "db_name"

[karianna]

Sounds reasonable, admin by default is actually a bit of a security concern.