basic test of format of public key in .well-known/browserid

not much, but would have prevented a regression.  

next up, more tests of session management, certificate signing, etc.