Reorganize user authenticationo

This supports two types of authentication: browserid and external.

External authentication now only requires authentication of
`/userauth/login`.

Note that, for the moment, this breaks oAuth2.