Initial Keycloak work

* as stated in (updated) README: requires a pre-configured KEYCLOAK
* as discussed on IRC: merging now; continue a closer/better integration on a new branch