cleaned up authentication code to allow for authTokens to represent a user session.  Also made it so LDAP and DB authentications can be interchangeable -- added unit tests for authentication classes