fix auth_spec for reails 3

 * use 'HTTP_AUTHORIZATION' for header, not :authorization or
   'Authorization'
 * fix stubbing of forgery protection (in Rails 3, the instance method
   doesn't chain to the class method)
 * fix re-ordering of AuthLogic callback chain for rails 3

Change-Id: I6f190995cee7fd54076e786b17eba430ae03a1c0
Reviewed-on: https://gerrit.instructure.com/30796
Tested-by: Jenkins <jenkins@instructure.com>
Reviewed-by: Derek DeVries <ddevries@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>