Clarifications to section 7.8

Addresses #367.
I can see that this is misleading and will re-word/re-position.

What I mean to say here is that the actual header of the request will have a Content-Type of  application/x-www-form-urlencoded whilst there will be a form parameter of Content-Type application/json. This is shown in the appendix G example I've added.

Re the white listing, this also sounds like a good idea. I'm going to take a look at the headers that TinCanJS burrows, but I'm assuming it will be:

* Authorization
* content
* X-Experience-API-Version

and possibly Content-Type. If that's correct I'll need to update the appendix G example and move Accept, Accept-Encoding and Accept-Language back to being proper headers.