Improve extensibility of middleware by introducing interfaces for AuthenticationOptions

Resolve https://github.com/aspnet/Security/issues/35
Good question!  In my working example (the one where I duplicated the Facebook middleware) I use HttpContext.Current to get the current Owin context in which I've already built up a TenantContext with other middleware.

```
HttpContext.Current.Request.GetOwinContext().Get<TenantContext>();
```
Is there a better way to get access to the context?

If not concerned about backward compatibility I might add a factory method to IAuthenticationOptions, perhaps BuildOptionsForRequest(HttpRequest request).  We might call that method from the AuthenticationHandler as part of the per-request work performed.  Honestly I haven't thought that through completely but that's probably the direction I'd head in.  Do you think that's a better design?  Personally I think HttpContext.Current is a fine way for auth middleware to get the context but perhaps I'm not seeing the whole picture.

Side note, I think there is a slight bias towards these AuthenticationOptions being static in nature (set once and forget), which probably makes sense for a lot of developers in simple scenarios, but add in even modestly complex requirements and that design breaks down quickly.  I think the bias should be towards per-request configuration -- after all, we're looking at every request already -- and then the default AuthenticationOptions implementation can just support a static configuration for the majority of "basic" users to roll out of the box.

Thanks for your thoughts on this, cheers!