Implement 'password' authentication for Bob

[amexboy]

Implement password-only authentication for Bob. As an execution engine, Bob should not care about user management. But to provide one layer of security Bob may be configured with a list of passwords that can be used to access Bob's apis.