Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
Does `strconv` do the right thing? I think I had this as a hack in the prototype, but is Go's string quoting appropriate for use in the header? I suspect it's sufficient if we're careful about what get's into `realm` and `service`.