Authenticated RPC calls using service accouts

[Alan Noble]

An alternative approach to one described in Issue #323, is to use Google App Engine service accounts to authenticate calls to VidGrind from OceanCron (and vice versa).

[Alan Noble]

Researching various approaches, one relatively straightforward method is to use JWT (JSON Web Token) to digitally sign the service account info using a secret that is shared between VidGrind and OceanCron.

[Alan Noble]

We can also digitally sign other useful request data as part of the JWT claims object, for example, the site key, rather than passing such data in the clear.

[Alan Noble]

Resolved by https://bitbucket.org/ausocean/vidgrind/commits/17f85e98a4d4745bd7e47a8b1fbf0b52b66a18c4