Authentication refactoring

This PR has the following changes:

1. The authentication plugin now supports multiple cooperative authentication backends. This allows for scenarios where for example both Basic as well as OAuth is supported.
2. The authentication backends no longer have state. They act purely on incoming Request and Response objects.
3. The authentication plugins and backend now provide information about the currently logged in principal. This was before in a very clumsy way handled by the ACL plugin, but this caused a lot of issues. The side-effect is that even for sabredav servers that don't use RFC3744 (most fileservers) the terminology 'principal' creeps in. This could be a bit confusing at first for people who write their own authentication backends.

Fixes #191 
@staabm I've actually removed `public` everywhere in all the master branches.

I think when public/private/protected was a thing for the first time when PHP 5.0 first came out, I wanted to specify it everywhere.. but now I find that it looks cleaner and clearer without :P The entire `public` keyword is pretty much has no purpose :)