FATH: Authentication-based Test-time Defense against Indirect Prompt Injection Attacks