Upgrade to Aspen 0.22.9 to address #526 and #528

Aspen 0.22.7 had a bug whereby outbound hooks weren't run, which broke
csrf as well as auth.
Fix regression in hooks API from test suite
Convert test_tip_json.py to Harness

This let's us use make_participant instead of a raw SQL insert, and we
can then set the claimed_time on the tippees so that it works with the
newer get_dollars_giving (18db48f1cfb3efa81f67ae99efe24e7b4dd2ed41).