Reintroduce noop token manager and refactor ServerPermissionClient

Signed-off-by: Joon Park <joonp@spotify.com>

docs/tutorials/backend-to-backend-auth.md

@@ -29,7 +29,10 @@ backend-to-backend authentication to work in production.
 Requests originating from a backend plugin can be authenticated by decorating
 them with a backend token. Backend tokens can be generated using a
 `TokenManager`, which can be passed to plugin backends via the
-`PluginEnvironment`.
+`PluginEnvironment`. The `TokenManager` provided in new Backstage instances
+generated by `create-app` is a stub, which returns empty tokens and accepts any
+input string as valid. To enable backend-to-backend authentication, you'll need
+to instantiate a new one using the secret from your config instead:
 
 ```diff
 // packages/backend/src/index.ts
@@ -43,6 +46,7 @@ function makeCreateEnv(config: Config) {
 
   const cacheManager = CacheManager.fromConfig(config);
   const databaseManager = DatabaseManager.fromConfig(config);
+- const tokenManager = ServerTokenManager.noop();
 + const tokenManager = ServerTokenManager.fromConfig(config, { logger: root });
 ```