Automatic merge from submit-queue

Put loopback authn/authz first in chain

We want the loopback token auth to go first in the chain, for performance reasons, and so the loopback token isn't seen by any remote token authenticators configured.

The loopback authorizer should also go first in the chain for performance.