Break auth from app

Follow-on to #1345 further improving our forms.

This one breaks out the authentication into a separate module with tests.
Very nice! I'd like us to get into the habit of using a `sinon.sandbox` with a restore call in a top level `afterEach` whenever  we use sinon. It saves trouble later when he suite grows tracking down stubbed methods that have not been reset.

```coffee
sandbox = sinon.sandbox.create()

afterEach -> sandbox.restore()
```

http://sinonjs.org/docs/#sinon-sandbox