[WIP][DO NOT MERGE] auth config

@liggitt I got bit again by building an auth config that was doomed to failure, so I've started throwing together a config file.  The idea is to describe each piece and the links between them.  Each resource type has a separate "instantiator" that is capable of validation and realizing a single type of the config.  There is an EnvInfo object that will contain resources that must be shared (things like that sneaky session).

It's still very loose, but at least it provides a way break apart the initialization and validation code for individual pieces and allows us to add additional pieces to the config without risking breakages to existing functionality. An most importantly, it prevents me from wasting time debugging bad configurations.

The way to do this is define a New that takes a path and has all of these imported and defined in an array and then returns an object.  We want to avoid this inversion of dependency like the plague