Make master take authenticator.Request interface instead of tokenfile

This is a simpler first step to pluggable auth (token or otherwise). Moved the tokenfile implementation to plugins/pkg/auth/authenticator/token
Would prefer to make it explicit here where the authenticator is coming from - having tokenAuthFile be an empty string is non-obvious