internal/v4: macaroon-based authorization

We configure a known third party discharge service
and issue macaroons requiring that the user be
authenticated before an access request is granted.

In this PR we use this authorisation only for the existing
authorized endpoints, and do not try to be sophisticated
in what caveats we add.

QA instructions:

Fetch this charmstore branch.

Ensure all dependencies are downloaded and
at the correct version:

	go get -u github.com/CanonicalLtd/rogpeppe-gocharms/...
	godeps -u $GOPATH/github.com/CanonicalLtd/rogpeppe-gocharms/dependencies.tsv
	go get -u github.com/juju/gocharm/cmd/gocharm
	
Ensure you have a JUJU_REPOSITORY environment
variable set up. If you haven't then:

	export JUJU_REPOSITORY=$HOME/charms

Build the charms:

	for i in identity keys charmstore; do
	    gocharm github.com/CanonicalLtd/rogpeppe-gocharms/$i
	done
	
Ensure you have a running juju environment. Then
deploy the required services:

	juju deploy mongodb
	juju deploy local:trusty/keys
	juju deploy local:trusty/identity
	juju deploy local:trusty/charmstore
	juju add-relation keys identity
	juju add-relation keys charmstore
	juju add-relation charmstore mongodb
	juju expose charmstore
	juju expose identity
	
Wait until all the services have started,
then find the public address of the identity server (by using
"juju status identity"):

	juju set charmstore auth-location=http://<identityserver-address>

Find the public address of the charmstore server; then

Then compile this program: http://play.golang.org/p/WwiP0hvx53,
call it bakeryget and try it with a charmstore URL that requires
authorization; For example:

	bakeryget http://54.234.106.234/v4/log

The above example should print "please visit this URL" followed
by a URL, which you should paste into your web browser,
which should take you to a USSO login page. Accept
the request, then the bakeryget program should
complete (with some logging) and finally print the
correct result, the empty list ([])

That's not sufficient. We authenticate on some GET requests too, such as log and pprof.