Added option to decide whether an auth plugin should be used during /login GET or POST.

In CAS lingo, whether the plugin is used when /login is accing as a credential
requestor (GET) or acceptor (POST).

Currently, multiple auth plugins only work together if they accept different types
of credentials.  And they work in an OR fashion (authenticating to one or the other
is good enough for authentication).  Ideally, I'd like the choice to AND checkers
(must successfully auth to all applicable checkers).

The x509 client cert checker is a good example of why choosing when it happens
links to this.  In the OR case, you want x509 to authenticate on GET (no need
to see alogin page if I'm authenticated by the SSL handshake).  But in the
AND scenario, the client cert should be checked during the POST request, and
then the username/password should also be checked.
Updated interaction of cred checker plugins in 2 distinct authentication phases.
BUGFIX: Error if no trust service was specified in /login [POST].

One of the unit tests caught this.  Hooray!
BUGFIX: Corrected error in 'renew' trust error handling; updated tests for client cert checker.