Add Sign-on-o-tron flow

This commit:

- Adds a /login endpoint that redirects to our signon provider
- Adds a callback endpoint to receive the user from the provider
- Reorganises the app slightly to pull the authentication stuff
  out into a separate file