STORM-347. (Security) authentication should allow for groups not just users.

This plugin will be called Authorizer.permit method which is only get checked if there is any operation being performed on the cluster or topology. I don't think it will be that frequent that it requires caching. If you think otherwise let me know I'll add the caching.