Fix auth bouncer requests

They should always be `GET` (for now, at least) and should exclude extraneous headers.
Not understanding why we are testing behaviour we define in the test itself (we are checking for a `405`, which we set above int `start_fake_auth_server`. Could you explain?