use authed requests for mapbox tiles (v4)

- use v4 of tile api
- use access_token on tilejson request
- doesnt change [geocoding](https://github.com/mapbox/tm2/blob/611afb6979193226353e6ac0966291874cd0f6bd/index.js#L421-L424), yet