Add composite authentication support

Add support for composite authentication using a new 'service token'
in addition to the existing 'user token'.

If no service token is present there is no change in current behaviour.

If a service token is present and successfully validated then additional
wsgi environment variables are set which services may use to allow or
deny actions in conjunction with the existing environment variables.

For now delayed authentication is not supported for service tokens;
if a service token is present but invalid then HTTP Unauthorized (401)
will be returned.

Change-Id: Idb97c075a59d716af8bc56875785b825625bf0c9
Implements: bp service-tokens