Allow defining default headers for all APIActionCreator requests

[jmrog]

Users have requested the ability to define default request headers that will be sent with all requests subsequently triggered by APIActionCreator. The expected behaviors are:

1. No default headers are set initially (before the user specifies any). request.headers should be undefined initially, for backwards compatibility.
2. Once default headers are set, they will be sent with all requests (and available on the request object sent to handleFailure, handleSuccess, etc.), unless the user specifically sets the header(s) to undefined for that particular request (in which case the header(s) will not be defined on the request object for that request).
3. Any headers specified for a particular request should be merged with the default headers. If the same header is specified for a particular request and in the default headers, the specified header for the particular request trumps the default.

PR forthcoming.

[jhorwit2]

[jmrog]

@jhorwit2 Thoughts on this? I set up the API slightly differently than we discussed offline because I think this way is a bit more friendly/secure (it keeps the defaultHeaders private and allows the user to set it using a static method that we guard with an invariant).

Relatedly, do we try to keep our LOC here under 80 characters? I saw a bunch of lines over that limit already, but the diff is hard to read. :-/

[jmrog]

Oh, I should probably add a test for the invariant, so I'll do that as well.