Updates VCR to match on request body

Starting to see issues where VCR selected the different authentication
response from a POST /token call than it should have.

The response being either "invalid_token" or new tokens very much
dictates if the correct things are being tested!

Also updates the filtering to normalise request body as well
Extracts mocking of password prompt

Specs need to cope with authentication in one of two ways, 1) prep the
spec with tokens (fudged to the recording) or 2) when using a user
application, cope with the password prompt that blocks the specs.
Refactors token management inside config

This brings some logic from error handling and isolates the token
management in the configuration.

The BBConfig class gets refactored around the token handling.

The unauthenticated logic from ErrorParser is removed. In trying to recover from
errors globally we are again going down the route of relying on a global config
to tell it to renew tokens.

Fixes token renewal when adding a new "user" client

Changes mean a lot of VCR recording needed updating to account for the
new authentication flows in place.
Ignores 1.8.7 failures on Travis

Seems VCR recordings from 2.0 don't work on Ruby 1.8.7 s rather than
worrying about the failures, we'll ignore them until either VCR is fixed
or we drop support for 1.8.7