Add API authentication helper.

This is a small helper service that takes Basic Auth credentials and turns them into custom HTTP headers that an API can look at.

Eventually this will grow to support OAuth credentials instead (but probably not in this PR).
These tests don't tell me very much about the thing being tested. I read them as "make a request with these parameters, look at the response".

I'd be happier if each test method explicitly set the backend data (even if that references a class attribute or module global) and explicitly asserted that the results match the expectations. That would allow me to read each test and understand the behaviour being tested without having to run around the code trying to match up things in different places.

(This is a bunch of work, so I'm happy to do it myself in a new PR.)