Composition behind auth not sending credentials

[andypattenden]

Describe the bug
When using composition with both parent and referenced Storybook behind basic auth, the referenced Storybook's stories.json fails to load with a 401.

To Reproduce

1. On a Storybook instance that uses basic auth, add a referenced Storybook which also uses basic auth
2. Build and serve the Storybook which references the other
3. The referenced Storybook will fail to load

Expected behavior
The referenced Storybook stories should be included.

Code snippets
I believe the issue was introduced by #12085, specifically https://github.com/storybookjs/storybook/pull/12085/files?file-filters%5B%5D=.js#diff-828d2f810232874c2eaa4fce5cbc555bR105.

The checkRef function in manager-config.js returns a Promise which is always truthy, therefore the ternary which sets the ref's type, will always be server-checked. This will then prevent isPublic and therefore the credentials header being set correctly for when the stories.json is attempted to be fetched here

System
Environment Info:

System:
OS: macOS 10.15.7
CPU: (8) x64 Intel(R) Core(TM) i7-8559U CPU @ 2.70GHz
Binaries:
Node: 10.21.0 - ~/.nvm/versions/node/v10.21.0/bin/node
Yarn: 1.22.5 - ~/.nvm/versions/node/v10.21.0/bin/yarn
npm: 6.14.8 - ~/development/bbm/patterns-us/node_modules/.bin/npm
Browsers:
Chrome: 85.0.4183.121
Firefox: 80.0.1
Safari: 14.0
npmPackages:
@storybook/addon-a11y: ^6.0.21 => 6.0.21
@storybook/addon-actions: ^6.0.21 => 6.0.21
@storybook/addon-controls: ^6.0.21 => 6.0.21
@storybook/addon-docs: ^6.0.21 => 6.0.21
@storybook/addon-knobs: ^6.0.21 => 6.0.21
@storybook/addon-links: ^6.0.21 => 6.0.21
@storybook/addon-viewport: ^6.0.21 => 6.0.21
@storybook/addons: ^6.0.21 => 6.0.21
@storybook/theming: ^6.0.21 => 6.0.21
@storybook/vue: ^6.0.21 => 6.0.21

[shilman]

Great Caesar's ghost!! I just released https://github.com/storybookjs/storybook/releases/tag/v6.1.0-alpha.22 containing PR #12709 that references this issue. Upgrade today to try it out!

You can find this prerelease on the @next NPM tag.

Closing this issue. Please re-open if you think there's still more to do.