add union auth request handler

@liggitt I chose not to change behavior, but I don't see a reason why AuthenticationSuccessHandlers should be the exact same object as AuthenticationRequestHandlers.  If you agree that such a restriction is unnecessary, I'll turn getAuthenticationSuccessHandlers into a method that checks the configuration and creates the necessary handlers based on knowledge of both AuthenticationRequestHandler config and AuthenticationHandler config.
any reason not to do varargs here? makes it a little nicer to call