[WIP][DO NOT MERGE] auth config

@liggitt I got bit again by building an auth config that was doomed to failure, so I've started throwing together a config file.  The idea is to describe each piece and the links between them.  Each resource type has a separate "instantiator" that is capable of validation and realizing a single type of the config.  There is an EnvInfo object that will contain resources that must be shared (things like that sneaky session).

It's still very loose, but at least it provides a way break apart the initialization and validation code for individual pieces and allows us to add additional pieces to the config without risking breakages to existing functionality. An most importantly, it prevents me from wasting time debugging bad configurations.

This belongs here, not in some static package def somewhere.  Anything that is core to a set of things really doesn't deserve to be in a static method, certainly not one other people can reuse