Authenticator improvements

The current Authenticator system, although ostensibly extensible, had design flaws that meant that actually making a new Authentication backend necessitated the copy & paste of a large amount of code.

This patch, which has been used in production for a couple of years now on a 2.4 site, addresses this in the following ways:

 * Authenticators have instance, rather than static, methods to make it easier to call overriden values.
 * As well getLoginForm() (which replaces get_login_form), we add getChangePasswordForm() and getLostPasswordForm(), so auxiliary authentication services can also be overridden.
 * Most of MemberLoginForm has been pushed into LoginForm, which is no longer abstract.  It relies on a few methods in the authenticator to fill in the gaps: getLoginFields(), supportsPasswordReset(), and authenticate(), meaning that creating a custom login form within some common constraints can be done more easily.
 * Similarly, ChangePasswordForm makes use of changePassword() and checkPassword() on authenticator.

In addition, there is a tweak to the change password functionality such that, if the password reset link has an expired autologin cookie, you can regenerate one with a single click.

I don't really expect this to be 100% ready for merge as-is, but I'd appreciate some code review.