* Changes remote exec KV read to call GetTokenForAgent(), which can use the acl_agent_token instead of the acl_token. Fixes #3160. * Fixes remote exec unit test with ACLs. * Adds unhappy ACL path to unit tests for remote exec.