ignore emacs temp files
seems good; replace local auth with basic auth, and test headers

The `Authorization` header can only be submitted once, so Hawk and
Basic auth compete. The tests are updated to only try one auth
method at a time. On 401, the tests ensure both WWW-Authenticate
headers are present (Hawk and Basic). On 200, the tests ensure no
WWW-Authenticate header was sent. When either auth method fails,
both methods report their WWW-Authenticate headers. I think this is
fine and good, but need to read the spec.