Please leave this on hold until we move the credential dance into oauth2client and update apitools, I will update this issue tomorrow.

Things to be done (added by @dhermes):

• Use oauth2client.client.GoogleCredentials.get_application_default(). This still is "open" due to Detecting GCE sometimes takes forever. oauth2client#93
• Cover GAE service accounts (done via implicit in get_application_default)
• Cover GCE service accounts (done via implicit in get_application_default)
• Cover JSON service account credentials (done via implicit in get_application_default)
• Cover 3LO for people just getting started (Adding 3-legged auth for users getting started. #539)
• Cover p12 service account credentials (moved in 404 error on the 'pip install cloud' step of Datastore Quickstart #412 to gcloud.credentials.get_for_service_account_p12)