Make auth interfaces more flexible

Allow AuthenticationNeeded/GrantNeeded interfaces to decide whether to handle the request, or let the default error response be written by the oauth server
If we have multiple AuthorizeHandlers, why not keep track all errors and only report back the ErrorList (kubernetes type) if no one is able to handle them?