This is a first pass at adding the ability to restrict access to
"buckets" of resources via an auth token header.

This adds a storage layer with sqlite. There's currently no
functionality for adding access tokens through the codebase so they
have to be manually added via the sqlite command line.

It is backwards compatible because resources without a "bucket" tag are
considered public so there should be no change in functionality for
deployments.