WIP: Separating auth methods from base

moving methods that handle authentication and displaying login from away from base

Cc @LukasReschke @MorrisJobke 
Todo: Log this properly including IP address and X-Forwarded-For header
We should also add a function to core that returns either the REMOTE_ADDR or the trusted X-Forwarded-For header if the server is configured to trust it.