Break auth from app

Follow-on to #1345 further improving our forms.

This one breaks out the authentication into a separate module with tests.
In this case I'm not creating any stubs or spies on any objects which have a lifecycle longer than a single unit test, so there's nothing to restore.