Novaclient authentication has possible failure case

[Gabriel Hurley]

When an unscoped token is retrieved with a username and password but no tenant, it is possible for keystone to return an access response without a service catalog. This, in turn, triggers a key error in novaclient's _extract_service_catalog method, which is converted to an AuthorizationFailure exception.

This is, in fact, perfectly acceptable because we got back the unscoped token we needed and just need to exchange it for a scoped token which will then include the service catalog.