Move most of auth logic into SecurityDelegate::CreateAccessToken

With local auth we will need to extract most of information from
macaroon auth code.

BUG=25768507

Change-Id: If7b31a1ba9a081dfae0cf8e9df6c8ed27bfe79c4
Reviewed-on: https://weave-review.googlesource.com/2049
Reviewed-by: Vitaly Buka <vitalybuka@google.com>