x509 auth

This adds x509 as the second "core auth" mechanism.  That means you can have
either Basic or x509.  Both will still work with tokenized authentication.