First steps to combined auth

Added some code to authc to combine the two kinds of auth (OAuth and session).

All the tests are breaking, but this is at least a start.
anyReadAuth() requires either client or user credentials
Fix errors in OAuth authorization path
Use setPrincipal() to set principal in createUser
Pass correct arguments for email
Fail early for URL-mismatch in confirmation email
Use messages as a collection object
Use notifications as a collection object
Better handling of confirm
Dike out the messages and notifications till I figure out how to make that work