AuthMiddleware now EnsuresRequestServices

This removes the need to ensure that a request container was created before security middleware (fixes: https://github.com/aspnet/Identity/issues/227)