Require the Tahoe-LAFS API authorization token to access the ZKAPAuthorizer HTTP API.

The entire ZKAPAuthorizer client resource hierarchy is now protected by this
token, ensuring any callers at least have local filesystem access to the
Tahoe-LAFS node.

Report "Parsing redeem response failed" better

it's unclear what a good testing strategy for this logging is.  should switch
to eliot soon.

Add more logging for spending decicions

Spend the ZKAPs when doing allocate_buckets

This makes for ugly logs though probably no functional impairment.

Greatly reduce the interval between redemption retries

So we'll just have a practical zero second delay

Combined with the new issuer behavior, this should not impose an
undue load on any part of the system while providing the most
responsive payment experience possible.

Avoid spending passes for already-uploaded shares

It gets in the way of Eliot logging.

Client-side two-phase spending protocol to reduce pass loss