Significant refactor for 1.1.0 API

Rename kerberos module to kerberos_. Our kerberos module itself imports
kerberos, expecting to get the kerberos package, but it currently gets itself,
which means none of the kerberos library routines are actually available and
everything is a non-starter. This follows PEP8 for what to do when you have a
variable that conflicts with a builtin. Add a trailing _.

Handle errors more sensibly: If authentication fails, the server response will
be passed to the user. This is likely to be a 401. A 403 would indicate
successful authentication with an unauthorized user. If the client requires
mutual authentication (the default, similar to SSL certificate validation in
requests proper), an exception will be raised so that the user does not have the
opportunity to accept an untrusted response. If they're okay without requiring
mutual authentication, then they can specify that when constructing their
HTTPKerberosAuth object.

1.x API Change: Request objects no longer have a send mechanism. We need to
either generate a session and send with that or just use the connection
connected to the response object. This was essentially stolen from HTTPDigest
authentication.

Fix incorrect implementation of mutual authentication. Performing another
request during mutual authentication does not make sense. We're authenticating
the response we already received.

Allow different settings for mutual authentication:

  * REQUIRED: all responses will be authenticated with the exception of errors.
    Errors will have their contents and headers stripped. If a non-error
    response cannot be authenticated, a MutualAuthenticationError exception will
    be raised.
  * OPTIONAL: mutual authentication will be attempted if supported, and if
    supported and failed, a MutualAuthenticationError exception will be raised.
    Responses which do not support mutual authentication will be returned
    directly to the user.
  * DISABLED: mutual authentication will not be attempted, even if supported.

Support authentication of redirects, sanitize untrusted responses.

  * Track multiple contexts so that if/when we can authenticate redirects, we can
    support redirects to different hosts.
  * We want to be able to return unauthenticated errors to the user because they
    can be helpful in debugging, but we want to ensure that their content isn't
    used because the user is trusting us not to give them untrusted data. Hence
    the SanitizedResponse class.

Use user supplied options when retransmitting authenticated requests

Generate a test suite.