Refactor authentication into part of relengapi proper.

This removes the dependency on Flask-Principal, and focuses all auth
info on `current_user`.

Token auth is temporarily broken.
Set permissions on HumanUser
Move authorization stuff into plugins, too
fix up tokenauth
update account template
require blinker too
remove unused 'make_support_class' method
Merge djmitche/build-relengapi:issue40 (PR #40)