Split AuthLockoutBackends into two backends - for staff and user.

Monitor failed login attempts and enforce timeouts
Add TicketUser class which implement AuthenticatedUser
Add token (authtoken) based authentication to User authentication backend.
Use staff authentication backends on login and when selecting staff's
authentication backend.