[WIP][DO NOT MERGE] auth config

@liggitt I got bit again by building an auth config that was doomed to failure, so I've started throwing together a config file.  The idea is to describe each piece and the links between them.  Each resource type has a separate "instantiator" that is capable of validation and realizing a single type of the config.  There is an EnvInfo object that will contain resources that must be shared (things like that sneaky session).

It's still very loose, but at least it provides a way break apart the initialization and validation code for individual pieces and allows us to add additional pieces to the config without risking breakages to existing functionality. An most importantly, it prevents me from wasting time debugging bad configurations.

identityMapper is a map of names to config information that includes a known "type" and an implementation specific map of config information.  The entries are named so that they can referred to by other pieces of the config.  For instance, a password authenticator will need to reference an identity mapper, a login authentication handler will need to reference a password authenticator, and an external oauth authentication handler will need to reference an identity mapper.