add union auth request handler

@liggitt I chose not to change behavior, but I don't see a reason why AuthenticationSuccessHandlers should be the exact same object as AuthenticationRequestHandlers.  If you agree that such a restriction is unnecessary, I'll turn getAuthenticationSuccessHandlers into a method that checks the configuration and creates the necessary handlers based on knowledge of both AuthenticationRequestHandler config and AuthenticationHandler config.
> AuthenticationSuccessHandler to delegate to any children which implement AuthenticationSuccessHandler

Yeah, that's why I was asking about the hierarchy.  I'm not convinced that it makes any sense to try to test an AuthRequestHaqndler for an AuthSuccessHandler interface.  The two seem entirely distinct. I think I'd prefer to have them be separate entities that are created just for the purpose and we never guarantee that the same instances of any type will be used.