Service Token Composite Authorization Specification

Adds Specification for using both service tokens and
end user tokens for policy enforcement.

Change-Id: I516c3d31f0f71ed517c0ea9f242020cea3037f05
Merge "Service Token Composite Authorization Specification"