add union auth request handler

@liggitt I chose not to change behavior, but I don't see a reason why AuthenticationSuccessHandlers should be the exact same object as AuthenticationRequestHandlers.  If you agree that such a restriction is unnecessary, I'll turn getAuthenticationSuccessHandlers into a method that checks the configuration and creates the necessary handlers based on knowledge of both AuthenticationRequestHandler config and AuthenticationHandler config.
The first thing we do with them (line 147) is use them as a slice to append additional handlers.  Combined with other comments, this seems like a stronger argument to create separate getter that creates the full set of authSuccessHandlers that we want.