Break auth from app

Follow-on to #1345 further improving our forms.

This one breaks out the authentication into a separate module with tests.