REP-819 Keystone V3 Filter

The mess that is Keystone v3! Comment on _everything_ so we can get this fixed up. =)
Right.

I'm working on adding the option for the service catalog now. So the code currently assumes that the service catalog is contained in the token response from Keystone, and we get that back every time we validate a token. Is that a good assumption? In the v2 filter, we would make a separate endpoints call.