Newly advertised plans are private by default

[#50082561]
support for using a CDN for droplet download URIs

specifically, CloudFront is supported for now, but configuration is
kept neutral (i.e. just called "cdn", and all optional)
don't configure CDN signing if no private key is set
fix cdn initializer to return file object
Users in orgs that have access to a private plan can see it

This allows us to control plan access at a finer granularity
[#50082561]
Remove flakey, low-value integration test
Merge pull request #51 from cloudfoundry/service_acl

Service acl
[#50331961] create presenters for user summary endpoint
stream bits from resource pool