Make default tests less strict

[andreaceccanti]

Some tests could be less pendatic:

• Delete tests now require 204, but probably 2xx is good enough
• audience tests succeed if the invalid audience is rejected with 40x
• we should additional pedantic tests that verify that when the audience is invalid, the HTTP status is 401

[giacomini]

According to the RFC, deleting a file can return 200, 202 or 204. We can accept exactly those three. Looking at the current failures, we can relax the success criteria of audience tests with invalid audience, accepting exactly 401, 403 and 404. In strict mode only 401 is considered success.