Fix UAA admin check code

[markdboyd]

Changes proposed in this pull request:

Related to https://github.com/cloud-gov/private/issues/2030

The proxy is currently returning a tuple ("Unexpected error", 500) from uaa.is_user_cf_admin if a non-200 status code is received from UAA. The app code doesn't inspect the actual value and instead only checks whether the return from uaa.is_user_cf_admin is truthy to determine if a user has admin access, whereas a user should only be an admin if the return from uaa.is_user_cf_admin is literally True.

• Fix uaa. get_client_credentials_token to raise exception on non-200 status code
• Fix uaa.is_user_cf_admin to raise exception on non-200 status code
• Add unit tests for updated behavior
• Fix app logic to only add admin role if session.get("is_cf_admin") is literally True (== True), and not just truthy

Things to check

• For any logging statements, is there any chance that they could be logging sensitive data?
• Are log statements using a logging library with a logging level set? Setting a logging level means that log statements "below" that level will not be written to the output. For example, if the logging level is set to INFO and debugging statements are written with log.debug or similar, then they won't be written to the otput, which can prevent unintentional leaks of sensitive data.

Security considerations

Currently, the proxy is improperly treating a user as an admin anytime the requests to UAA fail, which is obviously wrong and insecure. The updated code insures that errors from request to UAA will be raised and only literally True values will be accepted to determine if a user is an admin.

[JasonTheMain]

Amazing