Refine authentication mechanism

I made these modifications because I use this library to authenticate (non-browser) API calls as well as AJAX queries to the same resource. The AJAX queries are created by http://vitalets.github.io/x-editable/ and the API client is some Capistrano script written by another person. The AJAX queries are authenticated by a PHP session created in the application. The API queries are authenticated with an API Key.  These changes fix one problem and introduce a new feature. The fixed problem is the confusion about what happens when api keys as well as user authentication are enabled at the same time. Enabling API keys essentially disabled user authentication. Now they both work, and the new feature is adding PHP session support to digest and basic auth methods. I have more changes to come as I want to use many of the features in the library but some are constrained.