Allow to query the web site without copy/pasting the user SSL certificates.
The query should be like:
curl -X POST -H "X-Access-Token: ACCESSTOKENVALUE" "https://slaposmaster.example.org/myspace/my_account/request-a-certificate/WebSection_requestNewCertificate"

Access token is destroyed after usage.
The token validity is one day.

It seems it confuses newcomers for now.

This enables the right acl_user, instead only shadow one.

  setUpOnce is executed on save but afterSetUp is not.

  bootstrapSite should be invoked once per Test Case run instead a single
  time on save phase.

This prevent increasing the memory usage due to huge workflow history.

distribution check: added a few tests