add union auth request handler

@liggitt I chose not to change behavior, but I don't see a reason why AuthenticationSuccessHandlers should be the exact same object as AuthenticationRequestHandlers.  If you agree that such a restriction is unnecessary, I'll turn getAuthenticationSuccessHandlers into a method that checks the configuration and creates the necessary handlers based on knowledge of both AuthenticationRequestHandler config and AuthenticationHandler config.
> This feels really weird...

No.  What feels weird about it?  It's a getter, tied an interface that unions multiple auth request handlers together.  It seems like someday you might like to access them together.  In an explicitly typed system, returning a UnionAuthRequestHandler from NewUnionAuthRequestHandler() would give callers an obvious way to express intent as to whether they cared about the sub type or not.  And if they did, then access to this method is useful.  It might still be useful in go, but since they won't declare types by default I will admit that usage gets a little muddled.