API Authentication redux

[rrix]

We have been working on proposals for this, this issue will track:

• [ ] API authentication
• [ ] identity token trust chain
• [ ] bilateral discovery mechanism (AAs can discover businesses implementing DRP, businesses access a list of AAs in the data rights network)

[rrix]

in discussion with kevinr and the rest of the team this will probably happen in slow waves:

• move to signed-request data model in 0.6
• move from JWT to libsodium in 0.7
• service discovery mechanism somewhere between 0.8 and 1.3