First pass at swappable authentication

Currently, it `require`s the extension named `authentication`.  This
uses the `package.json` file to determine the entry point of the
module.

This isn't complete, but it's sufficient for our purposes at the moment.
In case you're interested, we just released a javascript client that authenticates clients through the xTuple web server via OAuth2: https://github.com/lynnaloo/xtuple-node-oauth-client. I'm not sure if the changes you've made will be compatible with this, but it's pretty cool and probably worth checking out.