Auth systems/AuthStack

Flows for login and signup.

User or ExternalUser as input to autocreate process
Does each Authn provider get to autocreate? How will an authn provider disable it, e.g., ldap
Is "more info" in Authn a generic additional step? Or does each provider handle it
Doe we have a "more info" on account creation?
Passwords should be moved to a library, so basic and centralauth providers (or externaluser's for them) can use the same Password formats