Api Key Authentication support DRAFT

I’m opening this PR to get some initial feedback on design and feature-complete-ness.  In here you will find:

* Create Api Keys through an `Account` instance
* Get Api Keys through an `Account` instance or `Application` instance
* Encrypted caching of Api Keys in the Cache
* Fixing the Cache to make use of regions
* Api Key request authentication via `Application.authenticateApiRequest`, supporting:
 * Basic Auth with Api Key credentials
 * Exchange Basic Auth credentials for an Oauth token
 * Validate a previously issued Oauth token
 * Set custom scope and ttl when issuing Oauth tokens
 * Read custom scope from previously issued Oauth tokens

As you review `Application.authenticateApiRequest` you will want to read this example app here, specifically this example route handler that would make use of the method:

https://github.com/robertjd/customerapi/blob/master/server.js#L5

Some discussion points:
 * There isn't a separate `authenticateOauthRequest` method, though `authenticateApiRequest` does return object types that correlate with the kind of authentication that occurred.  Though I didnt need to make use of that in my sample app, merely knowing if the user was asking for a token or not (by inspecting the request uri) was enough context.

* `ApiAuthRequestError` is pretty generic, and leaves it up to the end user to decide how to represent the error as a response (e.g. 500 or 401)

* I am not dealing with reading the request body in `authenticateApiRequest`, I expect that a framework has already parsed the body (see related todo below)

Todos:

* Rework `Application.authenticateApiRequest` to inspect `req.body` OR `req.params`, as these are the most common properties that are created by frameworks.  I would also like to make this function a bit more readable.
* Unit and IT tests for `Application.authenticateApiRequest`
* Docs
If this is to be congruent w/ the Java SDK, the type is named 'AccessTokenResult' because the word 'Oauth' as a prefix is redundant since Access Tokens are already known to be OAuth specific.  That being said, this class in in an oauth-specific package, a concept that doesn't really exist in JavaScript.

Any thoughts?