Allow authentication to be turned off

Allow authentication to be turned off with an environment variable. In
development it is convenient to be able to access the API without having
to provide a bearer token on each request.
Get allowed access tokens from environment

The easiest safe place to store these tokens at the moment is in the
environment.
Remove AUTH_TOKEN_PATH from config

It is no longer required, tokens are provided to the application
directly with the `AUTH_TOKENS` environment variable.
Tell Apache to forward the Auth header

By default Apache on Elastic Beanstalk instances is configured to no
forward the Authorization HTTP header on to WSGI.

See:
http://stackoverflow.com/questions/22279301/authorization-credentials-stripped-django-elastic-beanstalk-oauth
Fix tests for authentication

- Add some doctests around getting auth tokens from the environment and
  make it a bit more robust.
- Add managing of AUTH_TOKENS environment variable to the test helper so
  that it's explicit that the auth token is being set.
- Factor out the two test helper functions into their own module as
  they were starting to dominate the test module.