add cas support with a few tests
allow disabling of local logins.  In the instance where an .edu is using cas they may not want a user to be able to log in once the users credentials have been revoked in the system that feeds the CAS authentication server.  This is very optional
fix comment and remove url setting as it is not used.
Merge pull request #892 from eriko/cas_support

Cas support