Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
You mean, like #3094? Yeah, it's bothered me for quite some time. When I looked into that one, I think there was something in the behavior of Type that made it *not quite* a drop-in replacement, but I don't remember what it was.