Changed sanitization test to match query logic

This test used to read: "should sanitize the owner due to incorrect type," but
this is no longer how the query logic actually works. The query is currently
designed to coerce numeric arguments to strings when the underlying field being
queried on is a string, so this test (which used to ensure that the field
shouldn't be found) is no longer valid. Instead, I changed it to test that the
field is found despite the fact that it is queried for using a number instead
of a string.
Fixed test logic for "it should create a todo"

This test was trying to test for the existence of a POSTed row before it had
actually been POSTed. The POSTs were also failing due to some missing required
fields. I have ensured that the assertion occurs after the POST and that the
POST contains all the required fields.
Fixed test timeout due to missing done() call.
Created deployd symlink so tests use local code
Corrected README.md test-app instructions.