Clone of EnMasse issue-3049:
Document how the service admin can create external auth services which allow overrides for the host / port / realm. Also need to document how the tenant can use this.

Also: improve the auth service chapter organization