Added code to handle forward-unauthorized-requests without X-Subject-Token header
Fixed test to set endpoints before starting Repose, wait for the correct response code from origin