Adds auth package with token auth backend

Adds an interface for AccessController which handles verifying that a request has sufficient access for the current operation.

Implements a "token" AccessController which handles bearer tokens in the form of signed JSON Web Tokens.
We may want some package documentation here that explains the usage of this package. I suspect that other parties will want to provide their out implementation (such as silly auth).

```
// Package auth yada yada
//
// Yada yadoo ... import desired auth packages like this:
//
//     import _ myauth/package/that/gets/registered
//
// Yada, here's how to yada:
//
//     access := Access{ ... }
//     if err := accessController.Authorized(req, access); err != nil {
//         switch err := err.(type) {
//         case Challenge:
//             err.ServeHTTP(w, req)
//             return
//         default:
//             // Safety zone.
//         }
//
```

It's up to you how crazy we want to go with this.