Bug 988948: refactor auth a bit to allow something other than browserid
Bug 988948: support for header-based auth (meaning, LDAP at Mozlila)