add test that hits a live remote repository over http.

this careens a little more out of the reach of even "integration" testing than i'd like but is a spot that really needs to get hit.  wrapping it up to use a localhost url and spin up its own http server would be lovely future work.
fix issue where pulling down a release from a remote repository over dump http transport where the repo had been packed could cause mdm to fetch tags unrelated to the requested release.
Merge branch 'master' into stable
update changelog for v2.14.1