Use POST to access protected resources, plus some guessing at the proper URL format.
Wires got crossed and this is work from another branch. Commented out.
Point at Zulip instead of Humbug
Merge branch 'master' into oauth
Remove old comment
Fix request headers and username creation