Auth plugins

This supercedes #1358. 

Since some folks want a very simple default implementation for auth, and others want to be able to plug in a more full-featured implementation, I've focused on the problem of defining how Authorization plugs in.

In the process, I found I was unable to talk about that without also defining how Authentication and Group Membership should plug in.  

I've also removed the text from access.md about "userAccounts", since I no longer feel that is resource type has to be part of kubernetes.
I think clients always have to be told upfront how to auth/reauth.  So someone writing a client may take as cli arguments the type of auth they want to use and/or the endpoint they need to use, and a 401 simply tells them to return to that endpoint