Remove authorization header that is not needed
Add an authentication manager that simply looks at scopes of an oauth token
Work in progress [#70693782]
https://www.pivotaltracker.com/story/show/70693782