Authorization and Policies

Here are some thoughts on how to make authorization pluggable, and how to express authorization policy.
Do we want to put this in the APIServer or have a standard caching auth provider that people can chain before a bedrock auth provider?  I can see different users wanting different caching policies based on verb (no cache for write but a significant cache for reads).

We could also keep a cache per request -- that way things are consistent across a request but each request perhaps hits bedrock auth again.  That might be more complicated and require us to plumb through an idea of a "request" through a lot of code.