First pass at swappable authentication

Currently, it `require`s the extension named `authentication`.  This
uses the `package.json` file to determine the entry point of the
module.

This isn't complete, but it's sufficient for our purposes at the moment.
That's a feature we might want to implement as well as an extension. If you'd like to discuss collaborating on this, let me know. It might get done faster that way.