completely rewrote auth to use node-openid.

This is much more secure as we're checking association handles, making it impossible for a user to spoof a request. It also greatly simplifies our code base