Don't treat the Agent role as a restriction

Previously, the Agent role forced the user to only be able to post
metrics. Now, it checks the defaultAuthorizedRoles first and only
if the user has none of those roles does it check for
agentAuthorizedRoles. A user with roles in both will still have
full access

Added explanation of the Keystone Authentication/Authorization
to the README

Change-Id: Ib82a064fd00f25a96c9b5b5294ada301270ab93c
Merge "Don't treat the Agent role as a restriction"