Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
- allow logout handler to be overridden
It might be worth either stating that this could return None. Alternatively, should the default value just be ``LoginHandler``?