First pass at swappable authentication

Currently, it `require`s the extension named `authentication`.  This
uses the `package.json` file to determine the entry point of the
module.

This isn't complete, but it's sufficient for our purposes at the moment.