Use authed requests for mapbox tiles (v4)

- [x] use v4 of tile api
- [x] use access_token on tilejson request
- [x] update tests
- doesnt change [geocoding](https://github.com/mapbox/tm2/blob/611afb6979193226353e6ac0966291874cd0f6bd/index.js#L421-L424), yet