default-unauthenticated-handler retains query-string on unauthorized-uri

Fixes #68, extends the test to account for query-strings.

Sorry for changes in whitespace, my emacs is set to clean those automatically.