Add simple Active Directory Negotiate Authentication support

[fhars]

This adds elementary logic to authenticate using an existing AD kerberos ticket.

It handles this by authenticating when a user visits a specific login page, not by wrapping the whole app in the authentication logic (so it operates like the other play-authenticate mechanisms, not like a usual HTTP authenticated application).

[joscha]

uh, swanky, I like it :) Will have a look, thank you!

[joscha]

Thanks!