add kerberos login

[shensquared]

with kerberos we may hopefully ditch canvas altogether. may also be able to port my grades module from introml and streamline all the user/group backend.

but probably should be a long-term feature