Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
Completely unrelated; but we have a consequent number of `DotedObjectName`, could we have a version of dotted object name that also import the object ? Basically just `Type` should work as if you don't set `klass` it should take care of importing. Thoughts ?