Modify WebStatus auth to allow for external authenticators.

This commit modifies auth/authz such that implementations of IAuth can
specify custom login URLs. It also attempts to work around auth's
current assumption that all users will have a visible username and
password.

The intent is to make IAuth extensible enough that authentication could
be delegated to a third party identity provider (e.g. Google OAuth2).
In that case the custom login URL would point to the external service's
authentication endpoint and the IAuth.authenticate call would implement
whatever callback logic is necessary to verify and complete the authentication.

Users authenticated in this mode would have a unique identifier
("username"), but would not have a password. While they may have some
password-like access token, we leave it up to the IAuth implementer to
handle these in whatever way he sees fit.