auth overhaul and legacy GS auth

Continuation of !330 (closed).

This refactors the authentication system a lot and will make it easier to add other auth methods in the future. Testing becomes a lot easier as well.

Things left to do, both preferably as a plug:

• Set the user session id
• Reject user accounts that have been disabled.
• Migration of the password for the legacyauth