more hooks for authenticators

Allow authenticators to:

- register custom handlers
- change login and logout URLs
- replace the entire login form

This is enough to get oauth working with [this custom authenticator](https://gist.github.com/minrk/b823f6d0465c9a00fede) derived from [Kyle's example](https://github.com/rgbkrk/gitorn).

The weird thing about an OAuth authenticator is that `Authenticator.authenticate` is never called, it's all done with URL handlers.