Revise Controller_Rest - move "output" param parsing from after() to before().
This seems like a more appropriate place to throw 400 errors.
Revise RestInstaller to remove any guest access keys (defense-in-depth measure).
Revise how RestAPI::init() sets headers to work well if run more than once.
Fix bug in Controller_Rest::action_post() - Location header has no query params.
Rewrite rest module unit tests.  All pass!
Merge pull request #423 from shadlaws/fixes_20130619

Fixes 20130619