Change unscoped token fallback to be session aware

The existing way of sending requests to the auth_url was to override the
management_url for the duration of a single call. Aside from being ugly,
this won't work with session objects where the management_url is
ignored.

The tests for this behaviour have been previously merged to ensure that
the before and after behaviour remains unchanged.

Change-Id: I879adcb25dd373ab4a7b77b6539974e22220aad4
Convert shell tests to requests-mock

This finally gets us rid of the test fakes and will remove the
dependency on _cs_request.

Change-Id: Ibd09db9a09c49bfbcf0ffe1f150d7fe730dd51b7