Break auth from app

Follow-on to #1345 further improving our forms.

This one breaks out the authentication into a separate module with tests.
Sorry, yeah I get that, what I mean is if we set the convention now of always having a sandbox when we use sinon, then there will never be the confusion of when to use it and when not.