main: Avoid infinite "303 See Other" loops on certificate-only authgroups

Since we are now caching the authgroup selection, it is possible to
receive a form from the server that skips all user prompts.  If the
selected authgroup is set up for certificate auth only (no l/p) and the
client certificate is not valid, the server will render a new form which
shows only the authgroup dropdown.  Since our CLI caches this response,
we need to make sure it doesn't keep resubmitting the same response over
and over again.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>