Active Directory SSO through a reverse proxy's REMOTE_USER

We discussed the change internally and it would be difficult to nominate this for APR given the testing complexity and recurring cost.

It's a really interesting approach, just not in scope for master.