Factor out rest token / user stuff to test helpers

There's some testing code in the surge endpoint which will soon be
needed in the raw measurement endpoint. Move this to the test utilities
library.