Default starter kit with no auth to Drupal API.

[fiasco]

Is your feature request related to a problem? Please describe.
With the subrequests permission available to anonymous users in Acquia CMS, the starter kit doesn't require OAuth authentication to interact with public content from Drupal. Even for Preview and Revalidation (ISR). So we should make the default client unauthenticated with Drupal and provide examples of OAuth and JWT authentication.

[lauriii]

The client credentials authorization is still needed for previewing content. The default client is not authorizing all of the requests since #117.

Is there something else we need to do here other than move from client credentials to using authorization code grant?