Change authenticator API

Authentication now results in an AuthenticationResponse object, so that
we can pass error messages through.