posse-post-discovery: check Response.activity_json['url']

- when re-processing old Responses, check the top-level url field
  rather than the incorrect activity['object']['url'] field.
- more robust test - multiple sources, simulate common situation
  where instagram photo is PESOSed, then later POSSEd to twitter.
  we expect refetch to catch the updated twitter URL and erase
  the blank