Move authentication to Oauth2

**NOT READY FOR MERGE.**

There's still a bit more cleanup to do. Will update this with a checklist by the end of the night.

Feel free to bring up whatever you see, but be aware that I know a few things are hacky/misnamed right now. Just wanted to get this out there so you can get a feel for what the major changes will be.
This entire file needs to be removed. The secrets are sitevars and the auth config is in tba_config.