Now master services (scheduler and controller manager) all authenticate
using the master bearer token. This goes against the least privilege
principle but those run in the same process as the master itself, so
very little harm is to expect from this simplification.