Authentication and authorization support

Currently, PeopleMath has no support for authenticating users, or for restricting read or write access to any part of the application to certain groups of users.

I suspect many teams who might consider deploying this application outside Google would find this useful. Few would want the entire world to be able to read, let alone modify, all their data.

Many users would probably benefit from a more sophisticated access control scheme, where different teams have different groups of users who are able to read and write data associated with those teams.

Ideally the application should support a pluggable authentication scheme. The Google App Engine [documentation](https://cloud.google.com/appengine/docs/standard/go111/authenticating-users) suggests several options, but the implementation should not assume the application is running in Google App Engine; authentication should be abstracted such that you can drop in another mechanism if you want to without changing anything else.

Authorization should also be pluggable. The simplest implementation on App Engine would probably be to represent user groups as objects in Cloud Datastore, on a global and per-team basis (so a user would have access to a team if they are in *either* the relevant (read or write) global group, *or* the team-specific group). However, again, it should be possible to substitute another implementation for those not using App Engine. Some users, for example, may want to integrate with a role-based access control system inside their organisation.