initial work on api authentication

Hi @omgitstom @rdegges here's the initial work for the api auth that we've talked about.

An example of how to use it:

    uri = 'https://example.com/get'
    http_method = 'GET'
    body = {'grant_type': 'client_credentials', 'scope': 'app_scope1'}
    headers = {
        u'Authorization': u'Basic BASE64ENCODEDAPIKEY
    }

    app = client.applications[1]
    allowed_scopes = ['app_scope1', 'app_scope2']

    from stormpath.api_auth import authenticate
    result = authenticate(app, allowed_scopes, http_method, uri, body, headers)
    if result:
        print result.token
        print result.token.scopes
        print result.account
        print result.api_key
    else:
        print("Auth failed")

An example with Bearer auth is the same as above with a few minor changes:

    headers = {
        u'Authorization': u'Bearer BearerToken....
    }
    body = {}

The authenticate function works in a way that it accepts Basic and Bearer auth but will look in the body for grant_type and automatically generate a bearer token if the correct grant type is found (client_credentials).
The allowed_scopes variable is used to verify if correct scopes are requested, ie. the request verification will fail if the user has requested scopes A, B and C but the allowed_scopes are E and F. Also, the user is free to do additional checks after the auth (ie. check if the stormpath account is in specific groups and so on).

There might be some bugs that I haven't noticed but I will be adding tests (and docs soon) so I should catch them. I wanted to put the initial work in a pull request so you can let me know what you think and I will be updating the PR as new things get added.