put in a rough implementation of FormsUserAuthenticator and refactorted the SHA256 hash generator a bit. I'm still not confident that I'm doing the right thing in there, but this is not production code so it should be fine. Eventually, I will have to revisit this to get a true understanding of best security practices.