Some improvements to the cert checking

Unit-test the hostname matching (which is working fine, but talking about RFC2818 with a friend made me realise I never added concrete tests) and make the reason why we don't like the cert more explicit.

The last commit makes sure we handle the case where we have an anonymous connection in which there is no cert. This isn't really a security issue, since the current code would try to dereference a NULL pointer and crash.