Initial auth implementation

/to @raymondfeng 

## app.enableAuth()

 - Enable ACL based access checking via a `app.remotes().before('**, ...)` (before all) hook.
 - Requires every request to invoke a remote method be signed with an `AccessToken`

## bugfixes

 - Fixed a test that depends on a very specific line order for email headers
 - Fixed some basic issues in the ACL implementation