more hooks for authenticators

Allow authenticators to:

- register custom handlers
- change login and logout URLs
- replace the entire login form

This appears to be enough to get oauth working.