Single sign on login support, part one

This provides the beginnings to SSO login:

1) Canvas create user to ensure the accounts stay in sync (subject to change with team discussions on finalizing this design. Currently tries to enroll in course too.)

2) A method for the CAS server to check credentials. Needed for sso to work at all.

3) It does NOT use the CAS server for main platform itself. That will be a separate part two PR.
We shouldn't set this mode in production.  If we want to set it in staging or dev, we should probably use a config value.