pe-auth

I still need to do NotFound and Error. Also, I want to do Forbidden, but 
that means getting jwt-simple installed and actually mocking up the 
encoding and decoding of real JWT bearer tokens. Too big for this PR, 
might do that next.