Add API authentication helper.

This is a small helper service that takes Basic Auth credentials and turns them into custom HTTP headers that an API can look at.

Eventually this will grow to support OAuth credentials instead (but probably not in this PR).
As discussed in person, I opted for more end-to-end tests to start with
because I wasn't sure what exactly ``verify_request`` needed in order to
work and I wanted to check that requests actually had the desired result.

I agree we need a bunch of unit tests to test each piece of functionality.
I'll write a ticket for it.