Implement OpenID, and require it for the /submit endpoint

This closes #53 and closes #54.

The authentication system is set up so that we can switch to something else down the road if we like.