Refactor API interactions into a separate module

This provides an api module which abstracts away all the interactions with the API endpoint, so that actions don't need to know about building URLs, authorization, setting headers or parsing the response.

Only the authorization token from localStorage is now used, not that stored as part of the currentUser object in redux, so some components (e.g. pubsweet-component-login) will need updating.