expose Response interface for cuing downloads with content-disposition

the right way to handle this in general may be to deliver the right
mime type and let the user agent handle it. but there don't seem to be
more significant browser-compatible use cases for content-disposition
and it doesn't seem to make sense anywhere but a response class.

the approach here is to expose a simpler veneer for manipulating the header
to avoid some pitfalls
default Response to X-Frame-Options: DENY

this is a measure against a form of "clickjacking" - it tells browsers
not to put the content inside frames. probably it is better to have this
set in the web server config but this is an attempt to slightly improve
default security for people who do not use other response classes
default X-XSS-Protection on Response to cue stupid browsers
deliver JSON responses with header instructing browser to download

browsers should not be rendering JSON responses as HTML if avoidable,
this is a possible vector for XSS
mediate Mapper constructor adds through self.add() for consistency
in debug mode, warn about empty mapper at time of any map() call
option to let mappers know about canonicalize function

canonicalization should not occur inside the mapper because the need to
convey whether canonicalization occurred (or even worse, internally
be able to generate redirects) would unduly clutter the mapper interface,
which should be simple so that extension is easy.

If the dispatch calls canonicalize() then it can easily determine that
canonicalization occurred just by getting a different string back.
However, when a match fails, the dispatcher cannot know whether this is
due to canonicalization, without also trying the raw PATH_INFO at each
miss; and more importantly, it cannot determine whether a pattern is
always guaranteed to miss because canonicalize() will always return
something which does not match the pattern (e.g., ensure_trailing_slash
cannot match against ^/foo\Z).

This might be hard on users who are confusing themselves by writing
their URLs in a different canonical form than the one they chose, e.g.
because they don't really understand the trailing slash distinction.

Therefore, some individual mappers may OPTIONALLY be given a canonicalize
function to use in giving advice or fixing up patterns. They are able to
ignore this because it's not always practical. I don't know that this
needs to be interface standard but the provided mappers accept it.
FriendlyMapper complains about patterns which can't match with canonicalize
allow Resource methods to accept more generic signature

This is to make it easier to apply decorators like @WSGI, @transform
or whatever to the whole class.

Resource only cares about the first argument. If it is like environ, fine.
Otherwise, maybe it is a string representing the method. Either way only
the first argument is used in method dispatch and the rest is just
passed through.

Of course it's recommended practice to make the finally called app have
a particular signature, it's just that Resource isn't invoking that check.

The signature can't be totally unconstrained because we still want to
support the case of using raw WSGI apps and writing stuff like that
get(self, environ, start_response) or @WSGI handlers as get(environ).
rename reason_phrase to reason

this was just distastefully verbose and I don't care since nobody is
using this yet
more considered approach to redirects

First need to distinguish general redirects 301/307 from
GET-after-POST 302/303. 301 vs 307 is a matter of temporary-ness;
I think 301 is more generally useful unless you DO NOT want caching.
302/303 is a matter of browser consistency and 303 wins there based on
a few pages surveying browser behavior.
Response.send() for easier use outside @WSGI
default to nosniff to try to improve browser consistency

I am somewhat unsure this stuff shouldn't all be moved out to some
security middleware or something or handled in much more specific ways/
only by library users rather than in the library
test FriendlyMapper reverse briefly like RegexMapper test
explicitly test simpler case for RegexMapper reverse
trivia