Auth plugins

This supercedes #1358. 

Since some folks want a very simple default implementation for auth, and others want to be able to plug in a more full-featured implementation, I've focused on the problem of defining how Authorization plugs in.

In the process, I found I was unable to talk about that without also defining how Authentication and Group Membership should plug in.  

I've also removed the text from access.md about "userAccounts", since I no longer feel that is resource type has to be part of kubernetes.
In practice usually better to 401 - makes client behavior much more predictable (esp for Clients without control of their http library like browsers)


> On Sep 30, 2014, at 1:21 PM, roberthbailey <notifications@github.com> wrote:
> 
> In docs/proposals/auth_plugins.md:
> 
> > +    - The community can contribute Auth Plugins that integrate with a range of existing solutions.
> > +
> > +## Detailed Design
> > +
> > +### Authentication
> > +The key components of k8s Authentication are:
> > +  - an APIserver handler for `/auth/...` which gives clients Bearer Tokens to use with the `/api/...` endpoints.
> > +  - an IdentityProvider interface which is called by the `/auth` handler to determine identity (user string).
> > +  - an GroupProvider interface which is called by the `/auth` handler to determine group membership (slice of group name
> > +    strings).
> > +  - an APIserver handler for `/api/...` which checks for Bearer Tokens, maps them to user/group strings, or rejects
> > +    unmappable/invalid requests.
> > +
> > +#### The auth endpoint
> > +
> > +A first time user of the APIserver needs a token to access the API.  The user can either:
> Can we send a redirect to the auth endpoint if the user isn't currently authorized?
> 
> —
> Reply to this email directly or view it on GitHub.