Wider authentication support

[rmil]

Currently we are just limited to custom applications, we'll need to look into connecting with other platforms

[rmil]

We could have some sort of different levels of accounts (not for permissions). But where in the admin interface we essentially promote an account to be a "global" account. So when the user next authenticated we can intercept that password before it's hashed and create a new account with an external auth provider i.e. Keycloak or something LDAP-y. If we had this with Keycloak we could then federate with AD which would be nice.