auth: Remove .get_challenge (only used for security=server)