Intermediate development for client cert auth.

In progress.
Updated client cert code; added notes.
Getting closer-- started testing with my own CA.
Client cert checker *seems* to be working.  Needs more testing ...

I seem to be able to specify multiple checkers.  Here is an example command line:

  $ twistd -n cas \
  > --auth client_cert:subject_part=emailAddress:transform=strip_domain \
  > --auth file:./cas.passwd \
  > --ticket-store memory_ticket_store \
  > --ssl -k ssl/key.pem -c ssl/cert.pem --addCA ssl/ca.cert.pem --verify-client-cert
  > --realm basic_realm

This lets me log in using trust authentication (client cert) with my test client.
My browser, which does not present a client cert, gets the login page, and I can
log in using a username/password.

I'd like to clean up the logging of an error stack trace that says the browser
didn't present a certificate-- that could be cleaner.

I'd also like to have CAS respond in a more appropriate way if there are no
username/password cred checkers-- showing the login screen doesn't seem appropriate
in that case.
Trust auth error handling is now much nicer, giving a simple one-line log reason why trust auth failed.

Stack traces in log files are not fun to read when the errors/events should be well understood.
They are appropriate when something went horribly wrong and they are an aid to debugging.
If trust auth fails and there is no username/password auth, the 5xx error screen is displayed.

There might be a reason to have a customized view for this.
Or maybe this is good enough, and the error view can explain what happened.
Provide reasonable defaults for endpoint options and output final settings to log.
Updated documentation to reflect client x509 authentication.