Auth plugins

This supercedes #1358. 

Since some folks want a very simple default implementation for auth, and others want to be able to plug in a more full-featured implementation, I've focused on the problem of defining how Authorization plugs in.

In the process, I found I was unable to talk about that without also defining how Authentication and Group Membership should plug in.  

I've also removed the text from access.md about "userAccounts", since I no longer feel that is resource type has to be part of kubernetes.
We may want to draw out more details, but it's very difficult to handle reasonably complex auth flows from a non browser client.  We may want to spec two endpoints for auth - the one mentioned here that is a browser flow, and then one that is an implicit flow (responds with an Authorize header and the method).  Clients can either get and use a token via the browser, or hit the implicit flow endpoint and respond to the with challenge basic, digest, kerb, or ssl client cert.  I think it's up to the user to choose "I have a token" or "I can do this simple thing to get a token".  But the same endpoint can't satisfy both flows.