PEP-8 fixes for workflow controllers.
API testing helpers to run methods as alternative users.
Previous run_as method has some potential limitations, seems testing permission/security things is more correct if actually using normal alternative user key.
Workflow API tests for deletion functionality.
Various refactoring to reduce code duplication (in this and subsequent changesets).