Add support for webapi auth backends.

This adds support for custom auth backends for the webapi. API auth
backends are a simple class that pulls credentials from a request and
authenticates with them. They're designed to work for common methods
(like Basic HTTP Auth) and to be subclassable for something more complex
(such as one-time password tokens).

Multiple auth backends can be specified, and each will be tried until a
matching request is found. This means we'll be able to add Digest Auth
soon, in theory.