That depends on business requirements. In simple cases, auth can be as simple as dropping a little javascript on the page.

But sure, you can have follow-on stories like "user is denied access protected resource" or "admin sees resources accessed by user". Enough individually-useless stories and you end up with a useful app. That's kind of the point of agile.