Add authentication configuration

finishes PR #5384

Modifications from the original PR:

- pass settings around, not application instances
- add get_current_user as an extension point
- allow logout handler to be overridden
Scrap that. I did this for nbviewer not the notebook itself.