First pass at swappable authentication

Currently, it `require`s the extension named `authentication`.  This
uses the `package.json` file to determine the entry point of the
module.

This isn't complete, but it's sufficient for our purposes at the moment.
We are looking to integrate with LDAP. I think there's a way to use LDAP with oauth but not sure we have the time to figure that out right now.