First pass at allowing automatic login using GET

Limited to Google Apps domains at the moment, developers may define a SSO URL that has an additional formatting field (`identifier`) for adding GET data to the URL. The only supported GET parameter is `hd`, which is specific to retrieving an Apps domain's XRDS from Google.

This should be made more general—I'm not an OpenID expert, so all suggestions are welcome.