add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
Why wouldn't challenges be in order?  What if there are two format for bearer tokens?

----- Original Message -----
> > +import (
> > +	"fmt"
> > +	"net/http"
> > +
> > +	kutil "github.com/GoogleCloudPlatform/kubernetes/pkg/util"
> > +
> > +	authapi "github.com/openshift/origin/pkg/auth/api"
> > +	oauthapi "github.com/openshift/origin/pkg/oauth/api"
> > +)
> > +
> > +type unionAuthenticationHandler struct {
> > +	challengeHandlers map[string]ChallengeAuthHandler
> > +	redirectHandlers  map[string]RedirectAuthHandler
> > +}
> > +
> > +func NewUnionAuthenticationHandler(challengeHandlers
> > map[string]ChallengeAuthHandler, redirectHandlers
> > map[string]RedirectAuthHandler) AuthenticationHandler {
> 
> Hmm, I suppose… We'd want a consistent rendering of the redirect links… We
> could render in sorted key order, but it still feels odd to leave that up to
> the renderer to decide
> 
> ---
> Reply to this email directly or view it on GitHub:
> https://github.com/openshift/origin/pull/470/files#r21160258