gnutls: Handle empty (but not NULL) passwords on PKCS#12 certs

GnuTLS can accept PKCS#12 certs with either empty or NULL passwords[1],
but unlike OpenSSL[2], both options need to be tried separately.

[1] https://gitorious.org/gnutls/gnutls/commit/7c4c21c0e84a539558e3e1689d8a7b8a2c4c0056
[2] http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=a331a305e9c9c5353bd42db6dbda78a418285708

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
http: Handle gateways that skip TLS cert requests on initial connect

Some gateways do not send the TLS client certificate request until they
know that AnyConnect (not a web browser) is connecting from the remote
IP.  In this case it can be problematic to use HTTP keepalive, since
authentication may proceed without giving the client an opportunity to
present its certificate.

So, to be safe, when certs are being used we will defer the use of HTTP
keepalive until the gateway sends the auth form or we've answered an
XML <client-cert-request>.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>