Binding agnostic authenticators

Currently Unity authenticator is a fixed pair of verificator and retrieval. This makes authenticator binding specific, it is harder to configure the system.

Instead authenticator may automatically select a proper retrieval for an endpoint on which it is installed. Configuration of retrievals (minimal and so far only available for one vaadin retrievals of passwords and SMSes) should be put in authenticator configuration, under shared prefix.

In future we may need to add (either on endpoint or on authenticator) some hints for selection of proper retrieval if more then one matches the credential and binding. However so far there is no such case.