add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
would `AuthenticationChallenger`, with `AuthenticationChallenge` as the function name be easier to understand? I feel like we have an overabundance of handlers already, which is slightly vague as to which side of the equation it sits on...