TNL-782 each request should have valid ID Token

Each incoming request is expected to have signed non-expired JSON Web Token, containing information about user (sub), matching edx-notes client id (to be set in provider's database) and signed with edx-notes client secret (the same). 

https://openedx.atlassian.net/browse/TNL-782
<a href="https://github.com/tomchristie/django-rest-framework/blob/master/rest_framework/test.py#L138">client.credentials()</a> does not have such checks, so the header would still be sent, and the test would degrade into `test_malformed_token`