Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
Why is checking the key id important here?  It adds to the JWT spec but considering the signing key is always the x5c[0]  the key id should be able to be omitted.