posse-post-discovery: check Response.activity_json['url']

- when re-processing old Responses, check the top-level url field
  rather than the incorrect activity['object']['url'] field.
- more robust test - multiple sources, simulate common situation
  where instagram photo is PESOSed, then later POSSEd to twitter.
  we expect refetch to catch the updated twitter URL and erase
  the blank

(incremental improvement on #171)
maybe add `or activity.get('object', {}).get('url')`?