Add support for legacy validatePassword/getUser handlers and newer validate handler
Removed all dependency on passing 'app' for cansec.authorizer()