Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
If you have time, it might be better to declare these a time type that overrides TextMarshaler behavior to encode and decode from unix time. I don't see these types being used outside of the library, so this may have limited value.