authentication settings are now applied when creating and updating sites

including a major refactor taking influence from the webapplication resource
sorry no tests yet!