Integrate Microsoft.Owin.Security

[analogrelay]

Fixes #1659

This just integrates Microsoft.Owin.Security in to existing username/password and API key auth to prep for OAuth.

Test Notes

• Create some SHA1-password users before deployment (I'll send out instructions)
• Log in with various users having PBKDF2 ("new") and SHA1 ("old") passwords, verify that SHA1 passwords are replaced (instructions to come)
• Log off and try to directly hit a URL like "/account", verify redirect to login page and redirect back to "/account" after login
• Upload packages through the GUI
• Upload packages through NuGet push API
• Use NuGet push with no API Key -> Get Username prompt
• Use NuGet push with bogus API Key -> Get Forbidden response
• Use NuGet push with API key that doesn't own package -> Get Forbidden response
• Log in, then navigate to "http://[nuget site root]/" -> Redirects to SSL Homepage
• Log off, verify that the following Cookies are NOT present: ".AspNet.Cookies", ".ForceSSL"