Separated out setting the bearer token

Previously, when you used any of the behavious like "when I post to
/govuk_visitors" it would automatically set a valid bearer token. That
makes it difficult to test the access control functionality, as well as
the new "create collection" endpoint, which uses some *different* token
(not related to a collection)

I've made it so you can explicitly specify that the token should be set
based on the bucket you've already referenced. This paves the way for
setting alternative tokens (or none at all).