API Login validation

These change the API server so that it can be configured with an optional validator function for API logins. This will be used by machine agents to block agent logins during software upgrades while still allowing client logins (coming in a later PR).

There are 3 commits. The first is just a comment improvement, the second modifies apiserver.NewServer to take a struct instead of a long list of args and the third adds the validation support.

I'm not especially wedded to the "validator" name. Other suggestions welcome.
A part of me squirms here, but it isn't your fault.  It is the magic of the JujuConnSuite. The hard coded "user-admin" and "dummy-secret".  I'd much prefer constants, but they are used all over.  So don't bother here and now.