Add support for challenge and automation_allowed to toopher-python

Why? So that requesters (like SSH) can disallow automation, and require gesture challenges.