We should support authentication via external providers

[eemeli]

More specifically, at least Google, Facebook, and Twitter; so OAuth2.

Once a user has signed in using an emailed link or key, they should be able to connect an identity provided by an external service to their account, and later be able to use that to authenticate, rather than an emailed link.

If the user has not explicitly connected an authority, should we still trust a Google-provided email address if it matches one in our data?