Introduces token auth in a before action hook.

`before_action :authenticate` expected to be overridden for controllers needing finer-grained control over authentication.
Excludes certain pages from authentication.

Specifically the error, contact, pre-qualification and identification pages.
Page objects for the firms and error pages.
Adds a bare-bones factory for the "Principal" model.
Use timecop to freeze time during feature specs.
Adds a request spec to test token authentication.
Simple feature spec for e-mail verification.