Improve extensibility of middleware by introducing interfaces for AuthenticationOptions

Resolve https://github.com/aspnet/Security/issues/35
In the multi-tenant scenario how does the options implementer get access to the current request in order to decide which AppId to return? HttpContext.Current? That's not a pattern we want to encourage.  They'd also have to re-execute that discovery logic for every property call (AppId, AppSecret, Scope, etc.).

Would you do anything differently if you weren't concerned about back-compat?