Add basic authorization.

Added basic interface for authorizer implementations.
Added default "authorize everything" implementation.
Added authorization checks in each REST handler routine.
Added tests that these routines return forbidden error code
when the authorizer implementation denies access.


I figure people will either want to reuse all or large parts of pkg/apiserver/... (in which case they get these functions) or they will want to write their own thing entirely (different language or different rest framework.) 

If you don't feel too strongly about it, I'd like to leave it as is.  I like separating the interface file from the implementations.