Clients can continue to supply access tokens as query parameters
or can supply the token as a header:

   Authorization: Bearer <access_token_goes_here>

This matches the ouath2 format of
https://tools.ietf.org/html/rfc6750#section-2.1

Add helper function for getting access_tokens from requests

Rather than reimplementing the token parsing in the various places.
This will make it easier to change the token parsing to allow access_tokens
in HTTP headers.

Improvements to 3PE lookup API

Allow clients to ask for the whole of a single state event

Deduplicate presence in _update_states

Check if destination is ready for retry earlier

Track the max device stream_id in a separate table,

Fix tightloop on sending transaction

Correctly guard against multiple concurrent transactions

Reapply 34/device_outbox in 35/device_outbox_again.py since the schem…

Implement `only=highlight` on `/notifications`

Collect up all the "instances" lists of individual AS protocol results into one combined answer to the client

Fix /notifications API when used with `from` param