add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
whoami currently supports all the auth request mechanisms accepted by /authorize, but it would be simple to lock it down to bearer token only (actually, I should probably do that).  I think that a method like this has general utility, so that from the command line you can easily see who will be acting as when you run additional commands.  Maybe even return information like grants for the token as well.

I'll lock it down to only the bearer token auth request handler in the next set of updates.