Change @token_required to @permission_required

As part of adding the admin app, we want to make sure that Stagecraft
is checking permissions with Sign-on-o-tron.

Whenever a client of Stagecraft makes a request that requires a bearer
token, Stagecraft now uses that token to check directly with Sign-on-o-tron.
Permissions derived from this check are used to allow or deny access to
Stagecraft resources.

- Change the dev-data-set-query-token to be a generic dev OAuth token
- Add a development user which is controlled using configuration