Add API authentication

See Pivotal [#84570466](https://www.pivotaltracker.com/story/show/84570466)

Adds bearer token based authentication. Valid tokens are pulled from an environment variable (`AUTH_TOKENS`) for the moment as this can be easily provided to app without having to package secrets up in the deployment artefact.

Authentication can be switched off by setting the `AUTH_REQUIRED` environment variable to something 'falsey' (`no`, `off`, `false` or `0`).
Good call, I've added them and re-looking at this made me realise it probably shouldn't live here either so I've moved it out into a helpers module.