Add Sign-on-o-tron flow

This commit:

- Adds a `/login` endpoint that redirects to our signon provider
- Adds a callback endpoint to receive the user from the provider
- Reorganises the app slightly to pull the authentication stuff out into a separate file