Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
- allow logout handler to be overridden
I have some code which extends IPython's handlers to support a URL prefix, and I thought I saw something flash by on the Jupyter repo which also adds the functionality. Do we need to consider a URL prefix here, or is that not yet part of IPython?