Make password signin optional

[christiansmith]

Some deployments may want to avoid password signups altogether. It should be possible to disable password signups by configuration, so long as at least one third party provider is configured.

[christiansmith]

Password signin now needs to be configured as a provider: 8672813

// config.ENV.json
{
    // ...
   "providers": {
       "password": true,
       // ...
   }
}

This still requires some work on the endpoints to provide meaningful error responses when password auth isn't configured, and also to deny password registration unless configured.

[christiansmith]

2c81908