Test: dynamic HTTP responses for unit tests

cc @markelog 

While running around in circles for #279, I briefly thought the issue was connected to `X-Frame-Options` and had no reliable means of getting it to the client. This abuse of karma resolves that. I'd like to land it for now and open tickets and/or PRs against https://github.com/karma-runner/karma to make it unnecessary, but wanted to open it up for discussion first.