Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
May want to reword this to be "control whether a particular namespace may be referenced by a user", and a separate "add or remove objects in the system which result in namespaces being allowable".  Since we clarified that a namespace is a concept which is imposed outside the apiserver