Automatic merge from submit-queue

allow authentication through a front-proxy

This allows a front proxy to set a request header and have that be a valid `user.Info` in the authentication chain.  To secure this power, a client certificate may be used to confirm the identity of the front proxy

@kubernetes/sig-auth fyi
@erictune per-request
@liggitt you wrote the openshift one, ptal.