I don’t know why this didn’t come to me quicker, but I got some good advice on the Catalyst mailing list. It boils down to “look at how other people do it”, which I usually think of.
What I’d never thought of before was to look at their test cases for ways to do it.
Both Tomas Doran and Peter Karman made good suggestions of places to look for things that would help with my authentication issue.