Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
Yeah, completely, though DottedObjectName make extra checks maybe. Also sometime we might need delayed import ?