Add database-backed user/password authentication scheme

In this model, there are three kinds of groups of people that can be allowed
to perform an operation: anyone; anyone with access to the projecct, as well
as administrators; only administrators.  Right now, which operation has which
property is not tunable.

In implementing this, operations that anyone can perform have had their
'authorize' checks removed entirely.  This is not a very consistent way to do
this.  It also has the property that even unauthenticated users can perform
the action, which (depending on circumstances) may be desirable or not.