Add simple Active Directory Negotiate Authentication support

This adds elementary logic to authenticate using an existing AD kerberos ticket.

It handles this by authenticating when a user visits a specific login page, not by wrapping the whole app in the authentication logic (so it operates like the other play-authenticate mechanisms, not like a usual HTTP authenticated application).