add auth-related RFCs
add initial auth server spec
add quotes to reference descriptions
auth: clarify introduction of GET /authorization
auth: elaborate 403 error causes in /validate
auth: remove requirement registering live clients
auth: fix WWW-Authenticate header for /validate
add auth description to README
auth: add query endpoint for user roles
auth: add /represents endpoint
auth: only use 403 status to mean bad Auth header
auth:  whitespace
auth: missing header
auth: add details for POST /clients
auth:  allow non-confidential clients
auth: remove references to PAM

We might use PAM, or we might just use POSIX calls.
auth: clarify parameters for POST /tokens
auth: clarify generated fields in POST /clients
auth: add section for resource server APIs
auth: whitespace