When Glance use Cinder as a backend we want create volume from image to
be more efficient and clone the original glance volume where the image
is instead of downloading the Glance image to local disk and then copy
the data to the new volume.

For that we need to tell Cinder that it's OK to do that with the Cinder
volumes using the `allowed_direct_url_schemes` configuration option.

When Cinder receives a service token in the header KeyStone middleware
checks that the token is valid, but it doesn't automatically check that
the role of the token is actually that of a service, for that it needs
to be explicitly told so.

This patch instructs KeyStone middleware to check the role of the
service token when it is present in a request using the
`service_token_roles_required` configuration option.