Make TokenHelper an interface and split exisiting functionality

Functionality is split into ExternalTokenHelper, which is used if a path
is given in a configuration file, and InternalTokenHelper which is used
otherwise. The internal helper no longer shells out to the same Vault
binary, instead performing the same actions with internal code. This
avoids problems using dev mode when there are spaces in paths or when
the binary is built in a container without a shell.

Fixes #850 among others

cli/commands.go

@@ -25,7 +25,6 @@ import (
 	"github.com/hashicorp/vault/builtin/logical/transit"
 
 	"github.com/hashicorp/vault/audit"
-	tokenDisk "github.com/hashicorp/vault/builtin/token/disk"
 	"github.com/hashicorp/vault/command"
 	"github.com/hashicorp/vault/logical"
 	"github.com/mitchellh/cli"
@@ -275,11 +274,6 @@ func Commands(metaPtr *command.Meta) map[string]cli.CommandFactory {
 				Ui:          meta.Ui,
 			}, nil
 		},
-
-		// The commands below are hidden from the help output
-		"token-disk": func() (cli.Command, error) {
-			return &tokenDisk.Command{}, nil
-		},
 	}
 }