Reported by @ntozier

Separate authentication strike (excessive login attempts) count from timeout
enforcement.

SSO was originally used for a SSO plugin. The backend has since been
refactored to support other authentication backends.

authentication backend.

And add fixup rebase conflicts, and add nice page for unconfigurable plugins

Like HTTP authentication

This includes the initial concept of pluggable authentication along with the
initial concept for a plugin management system.

Uses a seven step procedure:
  1. (user) Fails to login twice or more
  2. Clicks the 'Forgot my password' link on the login form
  3. Submits the username or email address and triggers a password-reset
     email
  4. Clicks the link in the email and is directed back to the reset page
  5. Enters the username or email again and is logged in
  6. Password change is forced, but current password is not required
  7. Password is updated, user can continue the session without
     authenticating again

Use the actual error message set in Staff::login instead of boring "Authentication Required";