Auth isolation

Summary
-------------
Lower the coupling between the main application and authentication, account, and session management. In particular, decouple the identity service from any particular session implementation used by either an identity provider or consumer.

Motivation
--------------
In order to be able to adapt to different authentication environments it needs to be possible to easily override the dialogs we show during identity authorization and account management. For our identity module to be generically useful, it should define a provider interface where we can configure it for different environments. For instance, the identity service can have a differently configured provider depending on whether our application is doubling as an authentication client or if authentication, and potentially session management, are handled by a separate application.

Goals
--------
- [x] Don't reference account or auth directly in app.pt
  - [x] Share a single dialog sheet
  - [x] Get rid of the show-account directive
  - [x] Make it possible to override both dialogs together
- [x] Make account and auth part of the same optional bundle
- [x] Separate the identity service from the session service
Notably, `session['csrf_token']` remains for backwards compatibility, but you've just changed the name of the session key from `csrf` to `certificate` without similarly keeping `csrf` around for backwards compatibility.

Either we should nuke `csrf_token` as well (my preference, absent other context), or `csrf` should also be kept for backwards compatibility.