Get authentication working.

Authentication is now required (using OAuth style bearer tokens) to add
additional roles. It will also be required to remove them. The secret
key is currently specified in application.conf.