heat common : context should split roles from X-Roles

The auth_token code joins roles with a comma delimiter and stores
the result in the X-Roles header, so we need to split X-Roles back
into a list for the context (otherwise the oslo policy code breaks)

Change-Id: I32bd1d6355b6fe0e16e729f35b1d0b5c61346a70
Signed-off-by: Steven Hardy <shardy@redhat.com>
heat api : Add policy.json authorization to CFN API

Adds a basic policy.json to authorize all actions for the CFN API -
this will deny access to the in-instance users defined in stack
templates (which are assigned the heat_stack_user role) to all API
actions apart from DescribeStackResource, which is used for metadata
updates

ref bug 1115758

Change-Id: I1431c1f23593fffd0f911f71ef9c186a43e5063a
Signed-off-by: Steven Hardy <shardy@redhat.com>
Merge "heat common : context should split roles from X-Roles"
Merge "heat api : Add policy.json authorization to CFN API"