initial commit of some working auth code

This is exploration, subject to change etc, but /cc @fnd @pads
in case they are curious. The expectation is that there will be
technology benefits across the spectrum of tools.

twp.oauth is used to drive a login and registration process with
some caveats:

* the registration handler does not yet exist
* a challenger and extractor are in place to handle:
    * making sure there is an existing User for the `tiddlyweb_user`
    * challenger that just links to GitHub's authorize
* the details of the github auth server are in a non-checked in
  tiddlywebconfig.py because it has secrets in it
* A logged in user has a /dash but it doesn't do anything yet
* Once auth is done, a user gets a tiddlyweb_cookie. That cookie
  currently expires as the end of the session.

This version uses actual User objects with the username of the github
user. Another option would be to map (using twp.mapuser) a github
username to a chosen username, thus allowing other identity sources
(such as facebook, google+, amazone). Probably not going to worry about
that for now, but the option is there.

Using cookies is a bit weak here as it means that API usage is a hassle.
Will probably investigate creating revokable API keys

    http://cdent.tiddlyspace.com/plate#9a965420f6e74b98e31434d550af1528

thus being able to have both.