Refactor of the external logins 

Had this branch lying around for a while. The changes decouple the OAuth web security stuff from our code, and also allow the icons for the OAuth providers to be configured in the app settings.
> Do all consumers of the IAppSettingsProvider have to know about (and remember to concatenate) the AppSettingsKeyPrefix from the LoginMethodIconProvider?

No, only these tests. All of the icon settings are prefixed to group them in the appsettings. It's only these tests that need to add the prefix to the setting (as the login icon code is expecting to get a setting with that prefix).