Allow anonymous access to be enabled while using bearer tokens.

This update refactors the `RestTokenValidationFilter` so that it only serves the
purpose of finding a rest token (legacy or bearer) in the request, and setting
the security context appropriately if one is found.  If one is not found, it will
attempt to continue down the chain as an anonymous request (if enabled).

The token lookup has been abstracted out into a `TokenReader` bean, which
removes the need for 'if-else' branching, provides the functionality to other
beans, and makes the tests simpler.  The two implmentations are
`RestTokenReader` for legacy support, and `BearerTokenReader` which reads tokens
based on the RFC6750 spec.

The code which enforces that the request matches the bearer
token spec has been removed.  From my interpretation of the spec, these preconditions should only
be enforced as determined by how the bearer token was supplied.  For example,
multi-part requests are OK if the token is specified in the Authorization
header or query string, but not if it's specified in the request body.

This addresses #82, and fixes #80.