Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
This is to verify that the signing key in the `jwk` header field and the public key in the first cert of the `jwk`->`x5c` field are indeed the same. From [Section 4.7 of the Draft JWK spec](https://tools.ietf.org/html/draft-ietf-jose-json-web-key-38#section-4.7):
```
The PKIX certificate containing the key value MUST be the first certificate.
```

However, the [JWS Spec](https://tools.ietf.org/html/draft-ietf-jose-json-web-signature-38#section-4.1.6) says that the header may contain only the `x5c` field, which would allow us to avoid this check.