Moar authorization attributes

Based on PR #2117.

Future PRs will
  - refactor the growing code duplication in `test/integration/auth_test.go`.
  - replace injected Authorizer with a new authorization mode and acl file.
  - improve documentation.
 

I have a growing distaste for some of our handler code and its mechanism to parse parts - especially in parts of the kubelet code.  Can we just a put a TODO where we know a change will be needed when I look to put namespace in the resource path and not as query param?