Add sponsor authentication

[egnwd]

A sponsor should only be able to "sign up" providing they have a authorised email address and sign up, one-time code - with which they can then make a password.

My current thinking is extend the auth package to have an interface for any type of auth auth/email-password/CSG login. Also by creating a base Auth struct and have other types that implement the interface based off of the Auth struct (using go's struct composition). Very much open to thoughts on this.