Send headers for POST requests sent directly to server

[redshiftzero]

fix #25

this works but i'm marking this wip because the tests didn't fail when this issue was introduced (due to our reliance on VCR cassettes). we need to make a change to the tests also in order to detect any other defects

[kushaldas]

I was thinking vcr checks for all values, it seems it does not :(

We should not get this error in the proxy side as we check based on all input except the dynamic token or the totp value.

[redshiftzero]

I marked this WIP because as a general rule I don't like to resolve a bug without adding a regression test. there may be other issues that were not detected during merge of #21

[redshiftzero]

Regenerating all VCR cassettes would find defects like #25 - I've done this in 80b529d to ensure that there are no other regressions in the functionality for the SDK when one is not using the securedrop-proxy.

One can verify the fix in this PR by following this procedure:

Reproduce the bug

1. Reverting adac87f
2. Run the server dev container
3. rm data/test-star-add-remove.yml
4. python -m pytest -v tests/test_api.py::TestAPI::test_star_add_remove
5. See that the test fails.

Verify the fix

1. Apply the change in adac87f
2. rm data/test-star-add-remove.yml
3. With the server dev container still running:

python -m pytest -v tests/test_api.py::TestAPI::test_star_add_remove

4. The test should now pass.

Maintainers of this project should be careful to ensure that VCR cassettes and other mock request/responses are regenerated when PRs are proposed modifying the SDK logic.

[kushaldas]

This works as expected. To test, we have to comment out the @vcr decorator in the setUp function.