Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
- allow logout handler to be overridden
I think this might be better as a class method.