Refactor of the external logins 

Had this branch lying around for a while. The changes decouple the OAuth web security stuff from our code, and also allow the icons for the OAuth providers to be configured in the app settings.
Do all consumers of the `IAppSettingsProvider` have to know about (and remember to concatenate) the `AppSettingsKeyPrefix` from the `LoginMethodIconProvider`? It seems a bit like Countdown Code - "two from the top and three of your choice please Carol". 

It also feels a bit like you're replicating the behaviour of the real `IAppSettingsProvider` in this Substitute. 

Perhaps this is unavoidable, though - is `IAppSettingsProvider` one of our types, or a ASP.NET/BCL type?