Adds log message upon token granting

This change adds a log message when a token is granted for a user.

Change-Id: I21e87e54fe2eca552e403066ce9b3d5a20fbdb78
Closes-Bug: #1320302
Block delegation escalation of privilege

Forbids doing the following with either a trust
  or oauth based token:
  creating a trust
  approving a request_token
  listing request tokens

Change-Id: I1528f9dd003f5e03cbc50b78e1b32dbbf85ffcc2
Closes-Bug:  1324592
Qpid: advance thru the list of brokers on reconnect

Sync 877f1cab328fe8a9f8214687ea7e1287862de87d from oslo-incubator's
stable/havana branch.

In Qpid implementation, when using multiple qpid_hosts, we don't want to
immediately retry failed connection for the same failed broker. This was not
the case in existing implementation though, where we've always attempted to
reconnect starting from the first broker in the list of candidates. So if the
first broker failed, we initiated reconnect to the same failed broker.

This change makes reconnect() implementation to select the next broker in the
list. This also means that non-failure reconnect attempts will also switch the
current broker. All in all, users should not rely on any particular order to
use brokers from the list, so this should not constitute an issue.

Change-Id: Ia148baa6e1ec632789ac3621c85173c2c16f3918
Partial-Bug: 1261631
Ensure that in v2 auth tenant_id matches trust

Previously if a trustee requests a trust scoped token for a project that
is different to the one in the trust, however the trustor has the
appropriate roles then a token would be issued.

Ensure that the trust that was given matches the project that was
specified in the scope.

(cherry picked from commit 1556faec2f65dba60584f0a9657d5b717a6ede3a)

Closes-Bug: #1331912
Change-Id: I00ad783bcb93cea9e5622965f81b91c80f4570cc
Ensure routing key is specified in the address for a direct producer

Porting this fix from oslo.messaging.  This fixes the impl_qpid.py
driver to allow it to work with the latest stable upstream QPID broker
(version 0.28).  See the Apache Qpid Jira bug
https://issues.apache.org/jira/browse/QPID-5557

Change-Id: If71f78e50f8a9b3acfd1e9d02c8271f17c4ebee7
Closes-Bug: #1300318
(cherry picked from commit a90f0c6cfc44bc3c3fecec2f3b7281902cd6ec19)
add stevedore for testing with Keystoneclient master

stable/* tests run with Keystoneclient master and stevedore
dependency was introduced by "Plugin loading from config objects"
https://github.com/openstack/python-keystoneclient/commit/5c91ede44768ebbb2fff12f9a7c93e63b9bbd56d

Change-Id: If70a4114d73c71a1304cce6e937b0048213e730f
Updated from global requirements

Change-Id: If802220bebc8f213322b21771f09bb15236a33b6
Merge "Ensure routing key is specified in the address for a direct producer" into stable/havana
Merge "Qpid: advance thru the list of brokers on reconnect" into stable/havana
Add workaround to support tox 1.7.2

Conflicts:
	tox.ini

Change-Id: I58542f6e7dbbad98517c09b6176b9827f66dd1ff
Partial-Bug: 1348818
(cherry picked from commit 61b44eaceb3f57ef1d34e6a358398e36f49ba396)
Merge "Adds log message upon token granting" into stable/havana
Merge remote-tracking branch 'upstream/stable/havana' into stable/havana