Remove requirement that auth handshake should be done with HEAD verb

The reason for this is that it is beneficial to have the server return a
human readable text/plain body for the client to display to the end
user in case of failures. The text string after the HTTP status code is
not available in some frameworks, such as jersey but the response body is.
Prevent information leak from server when public key is unknown

This is done by creating a fake fingerprint which is the truncated hmac of username.