REP-819 Keystone V3 Filter

The mess that is Keystone v3! Comment on _everything_ so we can get this fixed up. =)
Keystone has the concept of unscoped tokens. An unscoped token doesn't actually provide access to resources but allows you to query keystone with questions about what projects you have access to etc. It doesn't actually allow you to make calls to validate tokens etc. By default, OpenStack keystone provides an unscoped token if the project id is not specified, but keystone can also be configured to give tokens a particular scope  in that case as wel -- that's how we'll run keystone on Rackspace BTW.  Anyway, if you set a project-id, you'll get a token scoped to that project -- which may be necessary in some cases.  For our internal implementation, we'd almost certainly always leave that blank.