Make authentication optional, disabled if not specified

This makes the authentication implementation a little more compatible with
previous deployments: unless you turn on authentication, it is disabled and
there are no restrictions to accessing the `/api` URL space.

When enabled this enforces the same rules as before: you must have valid
credentials to be able to access the namespace at all.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>
Implement command RBAC security checks

This adds the infrastructure to support permission checks for users, and ties
in all the commands to them.  This is the simplest version: it restricts based
on the command and the target object name.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>