Thanks to @Fieldistor for the reminder that gorilla/mux allows you to
disable cleaning request URLs, which was causing problems with signature
verification for some URLs.
Fixes#215Fixes#212
versions of all dependencies remain the same, but now use `go mod` to
manage them rather than govendor. This does result in a few extra files
being checked in, since govendor would ignore non-build files and go mod
does not.