Auth plugins

This supercedes #1358. 

Since some folks want a very simple default implementation for auth, and others want to be able to plug in a more full-featured implementation, I've focused on the problem of defining how Authorization plugs in.

In the process, I found I was unable to talk about that without also defining how Authentication and Group Membership should plug in.  

I've also removed the text from access.md about "userAccounts", since I no longer feel that is resource type has to be part of kubernetes.
The two-request flow traces the entire flow from unauthenticated user to authenticated user. It seems like the  one-request flow starts halfway through (with the user already authenticated). If the user was not authenticated, would the IdentityProvider return a redirect to a login flow (e.g. an SSO login on the same domain) or return an error?