android: added HelloActivity for fetching protected server resources
server: moved auth classes to auth package
server: added GoogleAuthInjectableProvider

Authorization header is now check for access token and a valid client
id, which limites the services to only those clients that should be
working with it.
android: added client id to auth header