We're going to need to use this from places that aren't password auth, so let's
move it to a proper class.

Provide a hook by which auth providers can be notified of logouts.

... so that they have a way to record access tokens.

Provide a hook where password auth providers can say they know about other
login types, and get passed the relevant parameters

Provide an interface by which password auth providers can register db schema
files to be run at startup

Document the existing interface, before I start adding new stuff.