Untested code to actually parse response tokens

Well, the start of it anyway.
Okay, how should this bit work?
Keep around a copy of the authenticator and friends

This way the caller can extract the subkey and stuff. Really we just
need to keep the authenticator, but it's nice to have a properly wrapped
KDC.Key object.

(Bleh. Maybe the ASN.1 code shouldn't emit bare objects.)
Be able to consume a token for the second leg of the authentication

Tested against the response to the xvm-remote.mit.edu.