Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
I am not sure how I feel about making validity a stateful property, especially since it's dependent on provided verify options. It's a little dangerous if the package gets refactored or modified. It looks like this is done as an optimization, however, we should probably optimize by ensuring that verify is only every called once.