x509 auth

This adds x509 as the second "core auth" mechanism.  That means you can have
either Basic or x509.  Both will still work with tokenized authentication.  The
'rhc server' command now also supports x509 certificates since previously there
were no support for keys.

One notable change is that this will always attempt to use Tokens if they are
configured.

Previously:

1) If rhc has a token it will use it
2) If doesn't think it can get one it will use 'core auth'.  Today it's
   only Basic Auth
3) If it falls through it will issue a bogus request that has no auth
   mechanism and rely on a 401 to trigger the token retry logic.

During the first request @can_get_token was always false since it's not set
until after the API has been fetched.

Now:

If tokens are configured they will attempted.  If one doesn't exist the Bearer
header value will be empty and trigger the 401 logic as before.