filled in doc.py and contact.py

Also,  the string "valid_user" is special for testing.  In the real world, this is a very long OAuth token that has a timeout.  To save ourselves the hassle of generating real Google Oauth tokens for testing I make the following check in current_user_token_info:
if app.config['TESTING'] and id_token == "valid_user":
      return { fake user with id: "11111...11111" }

"valid_user_contact" fails this test, and thus will make the API behave as if you presented an invalid authorization token.  If everything is working properly, All of the APIS should return 403, access denied.