added a system test to ensure handlers can access protected call data

There was a hole in our tests related to the protected attributes
on a handler's call data.  Because we designed them to be protected
(ie a tempalate should not be able to go `view.request`), it made
them difficult to test so they weren't tested.

This crafts a system test where the handler accesses each protected
attribute and returns that data in a json response.  The test takes
the response and validates the data is as expected.  If you remove
a protected attribute from the handler, this will fail.