Add API authentication

See Pivotal [#84570466](https://www.pivotaltracker.com/story/show/84570466)

Adds bearer token based authentication. Valid tokens are pulled from an environment variable (`AUTH_TOKENS`) for the moment as this can be easily provided to app without having to package secrets up in the deployment artefact.

Authentication can be switched off by setting the `AUTH_REQUIRED` environment variable to something 'falsey' (`no`, `off`, `false` or `0`).
Might we also want 't' and 'f' to map to boolean values?