[web] move AbstractAuthManager near its immediate concrete subclass [applied]