First hack at x509 auth

Posting this mostly for comments.  I haven't looked at writing the required tests yet.
In switching this I simply preferred the if/else so it's clear that one of the other of these is also going to fire instead of the hidden no auth request being part of the flow.  Looking at this again I would say that I should probably add a comment here explaining the mess we have.

Before there were 3 branches of logic:
1) if there is a token try it
2) if we can can't get one bypass it
3) submit a request with no auth an hope we get a 401

#3 happens is critical today with the token retry logic and I don't think we knew it.

With x509 there are cases where we don't have a token yet we know we can get one.  However if we submit a request with no authentication we will be blocked by Apache mod_ssl and will receive a 403.  If we change the no auth request logic to be an empty bearer token then we'll get a 401 and everything works like it does currently.