Plug that enforces bearer-token authentication on Micropub requests.
The expected token is read from the environment variable configured via
:auth_token_env_var (defaults to "BLOG_TOKEN"). Requests with a
missing or wrong Authorization: Bearer <token> header (or
access_token form parameter, per the Micropub spec) receive a 401
response.