Auth plugins

This supercedes #1358. 

Since some folks want a very simple default implementation for auth, and others want to be able to plug in a more full-featured implementation, I've focused on the problem of defining how Authorization plugs in.

In the process, I found I was unable to talk about that without also defining how Authentication and Group Membership should plug in.  

I've also removed the text from access.md about "userAccounts", since I no longer feel that is resource type has to be part of kubernetes.
We should probably avoid even examples which won't work with a stateless api server.  So either a signed assertion or a backed value.  I'm assuming one possible implementation is for the token used against /auth to remain the same as for API access and have a simple passthrough in play.