Allow security to limit API request access depending on domain

[DocSavage]

Sometimes DVID serves both public and private data access, e.g., data for published versions through a public domain as well as data for private versions through separate domains. Allow this kind of security based on optional configuration.