Require a valid bearer token for PUT requests

Most of this is taken from the HMRC manuals API:

    https://github.com/alphagov/hmrc-manuals-api/pull/29

gds-sso has a shared example which can be used to test the implementation of the
User class:

    https://github.com/alphagov/gds-sso/commit/81900f018fe6fc4c3ba31313ca07212eb98402b7

...but we aren't using it at the moment. The examples assume that the
app needs to support pushing of permissions, which we don't because we have no
persisted users and authenticate through signon for every request. We should
separate out the examples in gds-sso so that it's possible to use a minimal
shared example, with support for pushing permissions being optional, but until
then there's no point in implementing unused dummy methods here to make the
existing tests pass.