Client returns a list of profiles

* Authentication uses a permanent access token
* Profiles are currently just parsed JSON
* Set up WebMock and VCR
* Include actual access token in spec_helper:
  * This account has no sensitive data (it's all faked)
  * We'll revoke this access token after finishing the project