Work toward Python 3.4 support and testing

Change-Id: I7761f978535d47e68994304fca4b300d02210ee8
Updated from global requirements

Change-Id: Ifa619b1589942e4a81bd04c47ec8cfb239416a9f
Fix test failure after discovery hack

With the discovery hack, the test_auth_plugin is now trying to
query the unversioned endpoint from the catalog to discover what
versions it supports. Since that URL wasn't stubbed out with
httpretty it was causing a failure and then a different URL than
expected was returned by the plugin.

This change registers the discovery URL that's in the test token
so that fetching it doesn't fail but returns a normal version
response.

Related-Bug: #1335726
Closes-Bug: #1372190
Change-Id: I1ae41801ed44ec6a37d972f62fc853dfd609128f
Add composite authentication support

Add support for composite authentication using a new 'service token'
in addition to the existing 'user token'.

If no service token is present there is no change in current behaviour.

If a service token is present and successfully validated then additional
wsgi environment variables are set which services may use to allow or
deny actions in conjunction with the existing environment variables.

For now delayed authentication is not supported for service tokens;
if a service token is present but invalid then HTTP Unauthorized (401)
will be returned.

Change-Id: Idb97c075a59d716af8bc56875785b825625bf0c9
Implements: bp service-tokens
Support service user and project in non-default domain

The domain for the service user and project couldn't be configured,
so the auth_token middleware always used the v2 API and the default
domain. With this change, the deployer can configure the domain for
the service user and project and the auth_token middleware will then
use the v3 API to get the service token.

DocImpact
Closes-Bug: #1372142

Change-Id: I4f65adb523a591816a6cd807070d92ce6e414a1b
Fix auth_token for old oslo.config

When running with a havana-level of oslo.config (<1.3.0),
applications with any config options in their api-paste.ini will
fail to start with an error like

 'StrOpt' object has no attribute 'type'

This is because the config options didn't have a type attribute
until 1.3.0.

During the grenade test, the havana level of oslo.config is used.

Change-Id: I745c3e04f18941a2d41e191d43f61b926522bb9d
Closes-Bug: #1372422
Merge "Fix auth_token for old oslo.config"
Add an optional advanced pool of memcached clients

This patchset adds an advanced eventlet safe pool of memcache clients. This
allows the deployer to configure auth_token middleware to utilize the new
pool by simply setting 'memcache_use_advanced_pool' to true. Optional
tunables for the memcache pool have also been added.

Co-Authored-By: Morgan Fainberg <morgan.fainberg@gmail.com>
Closes-bug: #1332058
Closes-bug: #1360446
Change-Id: I08082b46ce692cf4df449d48dac94718f1e98a6c
Merge "Work toward Python 3.4 support and testing"
Merge "Add an optional advanced pool of memcached clients"
Merge "Support service user and project in non-default domain"
Refactor auth_token cache

There are very different paths for when we are encrypting tokens before
saving them to memcache. Extract the encrypted strategy out to its own
class to see the similarities.

Change-Id: I5bf5dae3143f15a840a580a2e01ba67c50911276