Allow authenticators to be chained with AND

This will allow decoupled implementation of the CnMatch, Fcrdns
and Psk authenticators.