/search response is now always hash

Hash is much more flexible. This change is safe to make once all clients are
requesting/expecting a hash.

Turns out there were quite a few tests using the previous default behaviour.