Added /whoami and integration test for authorization.

Added new endpoint /whoami for debugging authentication.
Added integration test which checks that a user is authenticated
using token authentication.
Rearranged initialization of authenticator to support preceeding.

I'm ok with always adding it, I just don't want people to confuse this for a public API.  We may want to prefix it with an underscore or something similar to that end.