Allow alternative security sources for REST API / Admin UI

Node attributes are not secure -- they can be read by every node.  Data bags are not a good way to store/ship secure credentials either.  I use Citadel which allows nodes with correct AWS IAM privileges to get files from S3 buckets, where I keep the data in whatever format I like (in this case JSON).