Spec authentication with password and api secret.

- Did a bunch of work around Client#requestToken that makes sure that
  only one token request can be in progress at once (meaning that auth
  requests will wait if needed).