createChallenge now takes request message instead of bare username

This to implement updated spec, handle non-ascii usernames and to embed
version information in the initial request.