Namespace keystone vars

Namespaced `admin_pass`, `admin_token`, and `demo_pass` under keystone.  These
vars are defined in the keystone role, and controlled by keystone, therefore
should be namespaced under keystone.