Start testing gittip.canonize

This is a step towards #940.
Fix a bug in the TestClient

We weren't exposing get requests to header config.
Here's a failing test for #940
Fix #940

If we set 'secure' for the session cookie when https is in use (i.e., in
production and not in dev) then we should never get a session cookie on
a request for http://www.gittip.com/, and consequently we won't set an
empty session cookie on the subsequent 302 response redirecting the user
to https://www.gittip.com/.
Tweak TestClient to not have spam bodies

With a default of None here were getting "None" as the request body.
That's not clean.
Merge pull request #1494 from gittip/issue-940

Fix 940