Sort out the her config loading about trade-tariff-admin

[saulius]

Can't we just set TRADE_TARIFF_USER and TRADE_TARIFF_PASSWORD (https://github.com/alphagov/trade-tariff-admin/blob/master/config/application.rb#L84) instead of uploading whole config file?

[jabley]

Needs to change to use OAuth anyway, rather than Basic Auth.

Basic Auth is being dropped from GDS SSO.

[saulius]

I'd gladly move them to OAuth, but I'm not sure what OAuth scheme should Tariff setup use. We protect tariff-admin with OAuth2 web flow and that works ok. But we also want to protect parts of the API (write side mostly) with OAuth2 as well (they are now protected with Basic Auth as James mentioned). How should this work with OAuth? Access tokens are issued per app, per user so I can't pass Tariff Admin's token to the API as bearer token unless we use same client_id and client_secret for both tariff-admin and tariff-backend. I'm really not an expert on this cross-app OAuth communication so any help would be appreciated.