Factor out rest token / user stuff to test helpers

There's some testing code in the surge endpoint which will soon be needed in
the raw measurement endpoint. Move this to the test utilities library.