REP-819 Keystone V3 Filter

The mess that is Keystone v3! Comment on _everything_ so we can get this fixed up. =)
So this is the way we did it in the Keystone v2 (client-authn) filter. I think the reason being that fetching the token and fetching the groups for a user are two separate API calls, and this allows us to cache the response from each independently. The defaults are also different between these two attributes (perhaps to account for the fact that groups change less often than tokens?).

I don't mind making this one attribute, but I think if we decide on that we should probably check with Jorge before making the change.