all protected all request from weixin

filter be defined to reject all fo unauthoriation request;
some tips when use 'rack-test' test post request how to handle request.body and params present? at same time,
should post '/foo=111?b=22', 'the request body', {}