Partner credentials

There's a fair bit in this PR... Summary of changes:
* Rework Public Credentials
  * Allow RSA signing of requests and client side certificates, but this can't be turned on via the PublicCredentials constructor. 
  * Base url is now an instance variable (needed later for partner credentials)
  * Store the token expiry date and provide expired() to check if token is still valid
  * There are no breaking changes - PublicCredentials work as normal
* Create Partner Credentials
  * Inherits PublicCredentials, constructor allows RSA cert and client side cert
  * Changes the base url to the partner one
  * Adds refresh() function to gain a new token
* Manager
  * Construct with credentials object instead of oauth.
  * Endpoint URLs are built using base url from credentials
  * Pass client side certificate to requests

This is a cleaned up version of a fork that's been used in production for a few months.