Refactor authentication into part of relengapi proper.

This removes the dependency on Flask-Principal, and focuses all auth
info on `current_user`.

Token auth is temporarily broken.
Set permissions on HumanUser
Move authorization stuff into plugins, too
fix up tokenauth