Add an end-to-end spec for some of the behaviour.

Adds some tests for the end-to-end behaviour.  These only hit the HTTP
API, and do no DB level manipulation.  A high-level test of the
black-box behaviour...