Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
- allow logout handler to be overridden
I can't remember if I added this function or not, but it might be worth elaborating this. What are the usecases of the function? Does it always have to return a single user? etc.