split zmq.auth into a subpackage

avoids unnecessary imports of ioloop when unused

- zmq.auth.ThreadedAuthenticator -> zmq.auth.thread.ThreadAuthenticator
- zmq.auth.IOLoopAuthenticator -> zmq.auth.ioloop.IOLoopAuthenticator

also cleaned up a few names, docstrings, APIs (support *addrs in allow/deny), etc.