Integrate Microsoft.Owin.Security

Fixes #1659 

This just integrates Microsoft.Owin.Security in to existing username/password and API key auth to prep for OAuth.

# Test Notes
- [ ] Create some SHA1-password users before deployment (I'll send out instructions)
- [ ] Log in with various users having PBKDF2 ("new") and SHA1 ("old") passwords, verify that SHA1 passwords are replaced (instructions to come)
- [ ] Log off and try to directly hit a URL like "/account", verify redirect to login page and redirect back to "/account" after login
- [ ] Upload packages through the GUI
- [ ] Upload packages through NuGet push API
- [ ] Use NuGet push with no API Key -> Get Username prompt
- [ ] Use NuGet push with bogus API Key -> Get Forbidden response
- [ ] Use NuGet push with API key that doesn't own package -> Get Forbidden response
- [ ] Log in, then navigate to "http://[nuget site root]/" -> Redirects to SSL Homepage
- [ ] Log off, verify that the following Cookies are NOT present: ".AspNet.Cookies", ".ForceSSL"