Improvements for external authentication (PR #10082)

See individual commit messages for details. This introduces some changes in behaviour, so should be merged after the 2.5 release.

GitHub

This pull request has been mentioned on Discourse Meta. There might be relevant details there:

Merged commits individually in ec448a15, 977766e7, 041d2829, 5284d41a