Initial review.

This is just to gather up general discussion from the initial review. Things that require code to be written should be spun out into separate tickets.

Outstanding discussion points:

- [x] try-finally around VoucherPool creation
- [x] issue_voucher return code when no voucher is available
- [ ] voucher.reason not accessible via the API
- [ ] unnecessary use of ** in `_audit_request`
- [x] separate API method for voucher pool creation