(auth) validate deis cluster requests

[jackfrancis]

This is a high-level issue to address the following concern:

• How do we verify that a write-request (HTTP POST) originates from a real deis cluster?

We don't want to overly complicate things and, say, store user credentials. But we would like, longer term, to disallow random folks from reverse engineering our elegantly designed API and sending us bogus data.

[arschles]

@jackfrancis can you put this into a milestone?

[jackfrancis]

We're currently considering rate limiting as a stratagem to address this. We're no longer seriously considering actually identifying cluster requests as coming from "real" clusters.

[jackfrancis]

Not critical for 2.0 release.