This involves a lot of copy-pasta of code from the previous version of
this logic in another code base. It'll need to be cleaned up, but for
now I need something sooner rather than later.
I originally wasn't going to do passwords, but after struggling with
webauthn I decided I'd just go for it. It simplifies the code a lot if I
assert that I always have a password, displayname, etc.
