Allow local mechanism to be enabled or disabled on a realm.

It should be possible to switch off the local mechanism - to achieve this it may be easier to add it to the <authentication> element so it can be omitted - i.e. the authentication element will now have multiple 'stores' defined and we will support the authentication mechanism of each of them, duplicate mechanisms will result in a WARN and the subsequent stores omitted.