An initial attempt at a backpack-connect MVC, with tests.

Things that still need to be done include:

- [x] Figuring out what to do if auth/refresh tokens [collide](https://github.com/mozilla/openbadges/pull/622#discussion_r3136872), and ensuring they're cryptographically secure enough for our needs.
- [x] Implementing the `/api/issue` endpoint.
- [x] Implementing the `/access` view as per the latest [mockup](https://github.com/mozilla/openbadges/issues/508#issuecomment-13575354).
- [x] Ensuring `Authorization` headers contain a Base64-encoded access token, rather than a raw access token.
- [x] Ensure that clients of the `/api/issue` endpoint can only push badges that were issued by them.

<!---
@huboard:{"order":3.625}
-->