Authentication

Authentication/authorization backends belong in haas/auth_mechanisms .  It's
possible that the API of that plugin will have to be expanded to cover what
the CLI needs to do.


WIP
We've been consistently using '.first()' for this elsewhere in the HaaS.  (most notably see _must_find() in haas.api)  Perhaps these should ALL use .one(), but I'd like it to be consistent.