[WIP][DO NOT MERGE] auth config

@liggitt I got bit again by building an auth config that was doomed to failure, so I've started throwing together a config file.  The idea is to describe each piece and the links between them.  Each resource type has a separate "instantiator" that is capable of validation and realizing a single type of the config.  There is an EnvInfo object that will contain resources that must be shared (things like that sneaky session).

It's still very loose, but at least it provides a way break apart the initialization and validation code for individual pieces and allows us to add additional pieces to the config without risking breakages to existing functionality. An most importantly, it prevents me from wasting time debugging bad configurations.

I find it hard to believe this was less readable than the resulting outcome. Maybe a few of the others, but this is pretty clear.  Maybe it's just the lots of flat functions.