Mirroring fixes v.2

Oops, last request left out some of the single_link_header logic. Here's a fixed version.

The idea here isn't to remove the single_link_header stuff, but to merge it back into single_link. With SINGLE_LINK_HEADER_TEST = False you get the live site behavior; with SINGLE_LINK_HEADER_TEST = True you get the single_link_header behavior.

This way:

(1) We don't have a bunch of duplicated code that's confusing to people like me -- it's more self-documenting.
(2) We don't have code that's diverging -- the single_link_header stuff is more likely to work over time because it inherits bug fixes from single_link, and when we do have to merge them we can just look at the explicit differences.

---

Original pull req. message:

This includes some changes I made to get mirroring running on perma-test. Biggest changes are that messages from the upstream server can now be signed with a public key, and post requests can't cross subdomains -- which means the confirmation screen for vesting always has to show, to get you on the right subdomain.