Mirror fixes

This includes some changes I made to get mirroring running on perma-test. Biggest changes are that messages from the upstream server can now be signed with a public key, and post requests can't cross subdomains -- which means the confirmation screen for vesting always has to show, to get you on the right subdomain.

I also replaced the single_link_header() view with a branch in single_link() based on a feature flag (SINGLE_LINK_HEADER_TEST). That way it'll still work despite other changes to single_link(), and I won't spend a bunch of time trying to debug the wrong function like a doofus.