Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
I think we can actually get rid of `Status` and `SetHeader` in the challenge interface. Careful implementations can set their own headers before the call to `ServeHTTP` and write their own body after. Anything more custom than that should require a custom error type (such as `SuperChallenge` or `OAuth2Challenge`).