Thanks to this future compatibility can be easily achieved.

Avoid cluttering vifib_slapos_core.

Providing portal type and tool in same BT5 does not work.

Tool is already present in another BT5.

It is simpler and produces understandable message in case of error.

Also factorise code to avoid repetition and increase readability.

HostingSubscription_requestRootSoftwareInstance is only used in one place, so, no compatibility problem.

Do not trust the catalog and check all attributes.

Simplify test method names. Put components in different test cases.

Allow for extensibility and separate logical components.

Fix state name.
Fix instance_xml, sla_xml.

As RFC says in http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.4.4:

403 Forbidden
(...) If the server does not wish to make this information available to the
client, the status code 404 (Not Found) can be used instead.

Prove that OPTIONS is header ignorant.
Prove that POST on instance require headers.

Allow to require any header.

Configure GET/POST on /instance to require application/json in Accept and
Content-Type headers.