don't reference external resources from browserid.org to not piss off SSL, and also a small pile of fixes to the testing harness -- specifically its handling of binary data, etc.