Begin introducing oauth2

Do not merge yet, this is a starting point to have conversations about introducing an oauth2 identity provider.  This may want to exist long term in a branch or under a flag.