Whitehall bug fix to enforce no auth over HTTP

Production issue came about due to Smokeys default behaviour of being authenticated for every HTTP request. A change was inadvertently pushed through staging and prod with undesirable protection on the whitehall-frontend vhost.

I've updated the `do_http_request` method to default to `auth: => true` and created an additional test which explicitly overrides this to be `false`. Note that preview requires auth by design and a cucumber tag has been added appropriately.