Improve the existing tests (so they actually work)

* Previously, the two existing tests were the same thing.
  Fix this.
* The PROTECTED_URLS and EXEMPT_URLS need to be moved
  into the method that configures settings in run.py,
  rather than living in their own, largely-ignored file.
* Switch off the sending of messages for testing
  purposes. It means we won't cover line 66 of
  login_required.py, but it also means we don't get
  horrible explosive errors about not having the message
  middleware installed/in use.