Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
```
	// Authorized returns non-nil if the request is granted access. If one or
	// more Access structs are provided, the requested access will be compared
	// with what is available to the request. If the error is non-nil, access
	// should always be denied. The error may be of type Challenge, in which
	// case the caller may have the Challenge handle the request or choose
	// what action to take based on the Challenge header or response status.
```