Add testing helpers

/to @bajtos 
/cc @raymondfeng 

Here is some example tests using these helpers:

This patch also includes some changes to the way tokens are authenticated. Can you take a look @raymondfeng?

```js
helpers.describeModel(app, 'accessToken', function() {
  helpers.staticMethod('create', function() {
    helpers.withArgs({});
    helpers.anonymously(function() {
      helpers.remotely('POST', '/api/accessTokens', function() {
        helpers.shouldBeAllowed();
      });
    });
  });
  helpers.staticMethod('find', function() {
    helpers.anonymously(function() {
      helpers.remotely('GET', '/api/accessTokens', function() {
        helpers.shouldBeDenied();
      });
    });
  });
  helpers.staticMethod('findById', function() {
    helpers.anonymously(function() {
      helpers.givenModel('accessToken');
      helpers.remotely('GET', urlForToken, function() {
        helpers.shouldBeDenied();
      });
    });
  });
  helpers.staticMethod('updateOrCreate', function() {
    helpers.anonymously(function() {
      helpers.givenModel('accessToken');
      helpers.remotely('PUT', urlForToken, function() {
        helpers.shouldBeDenied();
      });
    });
  });
  helpers.staticMethod('removeById', function() {
    helpers.anonymously(function() {
      helpers.givenModel('accessToken');
      helpers.remotely('DELETE', urlForToken, function() {
        helpers.shouldBeDenied();
      });
    });
  });
});
```