rails3: fix some security integrations specs

fixed:
- path doesn't include query params anymore, so we have to check request.fullpath
- need to replace Accept header with HTTP_ACCEPT

Change-Id: Ie1cd0ccbca3174f3788fbcb46066c27a4796569a
Reviewed-on: https://gerrit.instructure.com/30702
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Derek DeVries <ddevries@instructure.com>
QA-Review: Derek DeVries <ddevries@instructure.com>