create a "campaignAuthentication" application for all campaign-related authentication stuff

[PhilippMDoerner]

This is to separate general authentication (login) from campaign authentication (has permission to read campaign stuff).