separate heartbeat and selftest endpoints, and update specs.

* don't require api key for heartbeat, nor expose tracebacks.
* add tests for heartbeat.
* fix test with hard tabs.

JIRA: FOR-96
Merge pull request #94 from edx/jsa/heartbeat-no-key

don't require api key for heartbeat.