Make Auth class, for the others to inherit from

This takes care of almost all the things you need to do to implement a
new authenticator, including length checking of the key, allocating
buffers, checking returns.  It should be a lot less error prone.  It has
also stopped zero padding HMAC auth keys, which while convinient also
has security implications (to whit, a lack of security through a short,
guessable key).  The specs for these two classes still need to be
updated to reflect this.