Vault interpolation in vault stanza (original failure handling fixed)

### Nomad version
Nomad v0.5.0-rc1 ('a8c8199e413d387021a15d7a1400c8b8372124d6+CHANGES')

### Issue

Hi all,

I tried to use interpolation in the vault policies list, and found a couple of issues:
When I ran the job, the task got stuck in the `received` state. The server log shows that the interpolation isn't performed (would be nice to have), so nomad wasn't able to fetch the vault token.
In the case where the vault token can't be retrieved, shouldn't the allocation be marked as failed straight away?

```
» nomad alloc-status 71faeda1
ID = 71faeda1
Eval ID = 610afb08
Name = r53-backup.backup-script[0]
Node ID = 3d4e49a1
Job ID = r53-backup
Client Status = complete
Client Description =
Created At = 11/08/16 15:17:52 NZDT

Task "r53-backup" is "dead"
Task Resources
CPU Memory Disk IOPS Addresses
100 MHz 128 MiB 0 B 0

Recent Events:
Time Type Description
11/08/16 15:25:09 NZDT Killed Task successfully killed
11/08/16 15:17:56 NZDT Received Task received by client

```

### Nomad Server logs
```
Nov 08 04:20:32 nomad-server1 nomad[4970]: 2016/11/08 04:20:32.291945 [ERR] nomad.node: Vault token creation failed: failed to create token for task "r53-backup": Error making API request.
Nov 08 04:20:32 nomad-server1 nomad[4970]: URL: POST https://vault-experiment.acme.com/v1/auth/token/create/nomad-server
Nov 08 04:20:32 nomad-server1 nomad[4970]: Code: 400. Errors:
Nov 08 04:20:32 nomad-server1 nomad[4970]: * token policies ([aws-${nomad_meta_account}-r53 default]) must be subset of the role's allowed policies ([aws-test-r53 default nomad-server])
```

### Job file
Excerpt:
```
task "r53-backup" {
meta {
account = "test"
}
driver = "docker"
config {
image = "r53-backup:latest"

args = ["/local/backup", "s3://${NOMAD_META_ACCOUNT}-network"]

volumes = [
"${NOMAD_TASK_DIR}/secrets/.aws:/root/.aws"
]
}

vault {
policies = ["aws-${NOMAD_META_ACCOUNT}-r53"]
env = false
}
}
```

Use the provided job file and server-log reproduction as the starting case; trace how the vault stanza handles policies and Nomad interpolation. Confirm completion when the policies list can use ${NOMAD_META_ACCOUNT} and the resulting Vault request succeeds for the shown configuration.

Written by the indexing model from the issue text.