default-unauthenticated-handler retains query-string on unauthorized-uri

Fixes #68, extends the test to account for query-strings.

I've used util/original-url, to account for #42 too.

Sorry for changes in whitespace, my emacs is set to clean those automatically.