AuthSettingsController: refactor rendering

Instead of having one controller method ('auth_settings', which handles
POST) call another controller method ('index', which handles GET), have
both methods call a third, common '__render' method.

This makes it clear which arguments 'index' really takes (none). It's
also seen that the 'prefix_error' argument is always False, so it can
be removed. Finally, '__load_defaults' is no longer called twice when
POSTing invalid form values.