Move simple Authenticators into the top-level module

...and leave Internal for machinery that Authenticators can use.
Add "ResponseReceived" state