The Auth class has a __call__ method, which means Auth objects are callable. There's nothing special about the name "auth" -- it's just a convention. You could just as well do:
myauth = Auth(db)
myauth()
When you call auth(), it checks request.args(0) to see which Auth action has been requested and then calls the appropriate method (which in many cases produces a form).
Anthony