PEP-8 fixes for workflow controllers.
API testing helpers to run methods as alternative users.

Previous run_as method has some potential limitations, seems testing permission/security things is more correct if actually using normal alternative user key.
Workflow API tests for deletion functionality.

Various refactoring to reduce code duplication (in this and subsequent changesets).
Rename _workflow_from_dict to more clearly indicate it saves a workflow.
Make workflows API more REST-like...

... in backward compatible manner. New routes and deprecations exist for the following functionalities:

Running a workflow:

  Previously a workflow was run by POSTing to /api/workflows with an encoded workflow_id in the payload. This should now be considered deprecated in favor `POST /api/workflows/{workflow_id}/run`. Payload remains the same except workflow_id should not be included.

Uploading a new workflow as JSON:

  Previous route was "POST /api/workflows/upload", this still works but should be considered deprecated in favor of POSTing directly to /api/workflows. This second route had been used to run workflows (mentioned above), but only runs workflows if workflow_id is in the payload.

Importing a shared workflow:

  Previous route was "POST /api/workflows/shared", this still works but should be condisdered deprecated in favor of POSTing to /api/workflows/{workflow_id}/import.
A few a more fairly generic API exceptions, error codes.
Enhancements related to API workflow sharing.

Add ability to specify  and  when uploading new workflows via the API. Implement tests of this ability and use it to test importing shared workflows (recently added by Nicola). Small improvements to shared import exception handling.
Rework workflows API to use new decorator.

Use more helper methods to reduce method length, duplication. Improved testing, exception handling.