set AA on CNAME into referral, fixes #589

Not entirely happy with this, our AA logic is basically the wrong way around - we start out true and set it false in various places, while the RFC says 'set AA if the first thing you put into ANSWER is auth'.