Fixes to unit tests around policies

* Change to policy check signature to default to an empty target
* Tests for policy checks were very inflexible. Changed now so that
  for each API test policy rules must be explicitly provided, and
  tests must record which, how many, and in what order policy checks
  should be expected
* Test requests look more like actual requests; rather than calling the
  controller functions directly, tests go through the WSGI mapper/router
  infrastructure and all input/output must be valid as far as the wsgi
  is concerned.

Change-Id: I1dbf35249b4efd6ae9c85b08139e3a627fff6fc5