Full parsing of CompleteResp (SECURITY FIX).

Until CompletionResps were fully parsed (which we finally do it these
last two commits -- at least for the important parts), the app would
return right even for unsuccessful transactions, as long as PayPal
used a 200 status code.

Also, upgrade to the newest wreq, which also lets us bump lens up to the
newest version.