Write acceptance test for RBAC tk-auth rule

We should have an acceptance-level test for RBAC rules in tk-auth. We should be sure to test at least:
1) a token with the appropriate permission (allow)
2) a token without permission (deny)
3) a request without a token (deny)

This test should most likely go in pe-puppet-server-extension's test suite, since it is a PE-only feature of tk-auth, and doesn't require any special casing in RBAC. But we should double check this with the RBAC maintainers.