plugin architecture

not yet sure how a plugin would work for auth providers, but we can experiment with an acl provider plugin since it just needs to implement a simple interface with not any crazy dependencies.