Make authentication optional, disabled if not specified

This makes the authentication implementation a little more compatible with
previous deployments: unless you turn on authentication, it is disabled and
there are no restrictions to accessing the `/api` URL space.

When enabled this enforces the same rules as before: you must have valid
credentials to be able to access the namespace at all.

Signed-off-by: Daniel Pittman <daniel@rimspace.net>