Fix auth bouncer requests

They should always be `GET` (for now, at least) and should exclude extraneous headers.
This tests that the fake server returns `405` for `POST` requests so that we know that `test_owner_from_bouncer_post` (further down) is testing correct behaviour.

The latter test should fail if the auth bouncer request uses the original request method (which it did prior to this change) and my first implementation of that test passed incorrectly because the fake auth server was accepting all request methods.