Use salt.auth.Resolver instead of LoadAuth to allow non-root use

This allows non-root users to generate Salt tokens given eauth creds.
Added note about the CherryPy server config options for external servers
Added missing versionadded for the local_batch client addition
Remove special mocking for uppercase names

I'm not sure what this was supposed to do. But it causes the occasional
problem when mocking things that have no business being capitalized but
are anyway.
Move tool declarations out to the module-level

This allows the tools to be used as decorators throughout. I don't
remember why I moved them under get_app() in the first place. (Problem
building the docs, maybe?)
Don't authenticate GET requests to the root URL

This will allow us to present helpful information. Like how to log in!
Move auth and token handling out of main class

This allows us to more granularly define which views are and aren't
authenticated without having to undo settings in a bunch of places.
Added max_request_body_size as a config option and lowered the default
Moved example config to the top of the docs
Added note that config options do not apply to external servers
Removed unused os & textwrap imports
Moved web hook security notes closer to the top of the docs
Improve documentation on the new stats URL
Require authentication for the stats URL
Replace another auth.Resolver instead of LoadAuth

Missed this one in 4e146ca.
Don't return a 401 for GET requests to the login page

It doesn't tell us anything useful so don't do it. Since hypermedia
negotiation isn't yet complete, I'm not counting this as a backward
incompatible change.
Removed requests-based test suite; tests were absorbed into cpy suite
Added utils dir and a helper for testing CherryPy apps
Added note about local modifications to BaseCherryPyTestCase
Renamed 'data' param to 'body'; added 'qs' param

Rather than infer things about the request base on args/kwargs, make
both the body of the request as well as any querystring explicit
parameters.