Require that 403 response for faux login attempt includes X-SpiderOak-API header.

Fixes #326.

This verifies, only during the course of attempting a bogus login to validate an server address chnage, that the server is passing the spideroak-API-specific 'X-SpiderOak-API' header in the 403 response.