I prefer the auth handler to worry about all auth, and register to call
into it as needed, than to smatter auth logic between the two.

Don't get apservice interested rooms in RoomHandler.get_joined_rooms_for_users

I made the non-test seconds instead of ms, but not the test

Ensure we never return a None event from _get_state_for_groups

Set request.authenticated_entity for application services

Re-enable receipts API.

Fix pending_calls metric to not lie

This just replaces random bytes with macaroons. The macaroons are not
inspected by the client or server.

In particular, they claim to have an expiry time, but nothing verifies
that they have not expired.

Follow-up commits will actually enforce the expiration, and allow for
token refresh.

See https://bit.ly/matrix-auth for more information

Add and use cached batched storage.get_state function.

Federation for end-to-end key requests.