Add test for app-only vs user-auth creds
Support alternating with multiple credentials

Instead of `*creds*` (which continues to work as before),
clients can now choose to bind `*multi-creds*`, which should be of the
form `(atom [cred-1 cred-2 ...])`. If `cred-1` fails, the atom will be
`swap!` cycled to something like `[cred-2 ... cred-1]` and re-tried one
time.

The recommended use is to include both your application-only credentials
and user-authenticated credentials in `*multi-creds*` for any call that
allows application-only authentication. That includes all of the calls
made by `score-user`, but notably excludes `block!`.