Keystone v3 improvements.

Managers for project group membership, project user membership, project combined membership (users and groups); for group project membership, group users, group roles; for user project membership, user roles.
This came from me using openclient from my laptop, hitting my private stack (which uses the self-signed cert). 

Most everywhere else, params are propagated from the manager helper methods to the underlying client methods (create -> post), but for authenticate, we call post without forwarding params. Anyone authenticating against keystone served via self-signed HTTPS should hit this problem, provided they didn't add themselves to the underlying system as a trusted CA; not sure how others haven't come across it.