authentication refactoring

This change makes the bokeh server authentication authentication more pluggable (one can create a new authentication backend and get finer grained controls over who can access which documents)
also renames check_read_auth_and_create_client and check_write_auth_and_create_client
since we're no longer creating clients anymore in those functions

There is no reason to merge this before 0.7 release, so we should wait till after, but the changes should be fairly benign