Add basic bearer token checking

Add a minimal bearer token checking decorator as per RFC6750 [1].
Marking a route as requiring authentication is done with a decorator so
that we can easily add it and remove it from routes.

[1] https://tools.ietf.org/html/rfc6750
Allow authentication to be turned off

Allow authentication to be turned off with an environment variable. In
development it is convenient to be able to access the API without having
to provide a bearer token on each request.
Get allowed access tokens from environment

- The easiest safe place to store these tokens at the moment is in the
  environment.
- Factor out the two test helper functions into their own module as
  they were starting to dominate the test module.
Tell Apache to forward the Auth header

By default Apache on Elastic Beanstalk instances is configured to no
forward the Authorization HTTP header on to WSGI.

See:
http://stackoverflow.com/questions/22279301/authorization-credentials-stripped-django-elastic-beanstalk-oauth