etcdserver, auth: turn Quorum on in requests of auth checking

[mitake]

The auth information shouldn't be stale. Turning on the Quorum flag
for the request would be required for consistent auth.

[xiang90]

This is going to make auth even more expensive. I guess it is fine to just use get. If one peer is not synced, you will not get any sensitive data anyway. User should first enable auth, then put data. This order of actions will be the same with or without quorum get.

[mitake]

However, roles can be granted to existing paths. In such a case, sensitive data can be read based on stale auth state, I think.

[xiang90]

@mitake In that case, yes, there is an issue. But I think user should always deny all path, then enable some paths not verse.

[mitake]

@xiang90 the scheme will require unconditional disabling permission under / when a user enables auth. It seems to be very big change which breaks compatibility.

I'll do a benchmark and share the result for showing overhead introduced by this PR (I'm not sure the overhead is huge or not).

[xiang90]

@mitake

the scheme will require unconditional disabling permission under / when a user enables auth. It seems to be very big change which breaks compatibility.

That is basically what users really should do if they want security.

[mitake]

The problem will be fixed in the v3 protocol.