AuthN + AuthZ solution for customer-facing site + app

[rlmartin]

Related to #18

We currently use an internal implementation of OAuth. This is focused on authN; guessing that authZ isn't a concern but maybe that is incorrect.

[ruxy]

Need to pull pricing implications for site + app.