The first time serialize_object built a payload, it would store a copy

of it, and then return the original. The copy was intended to be an

original version of the data that the caller couldn't mess with.
However, a second call would return the copy directly. If the caller

then modified it, a third call would end up being affected.
We now always return a copy, and never the original payload.

The new unit test failed before this. Works after.
I also tested the repro case found in Review Board, which failed before

this and worked after.