separate heartbeat and selftest endpoints, and update specs.

* don't require api key for heartbeat, nor expose tracebacks.
* add tests for heartbeat.
* fix test with hard tabs.

JIRA: FOR-96