add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
> why wouldn't I just use the /user/- call to get myself?

I'm sure this should be obvious, but where is /user/- registered and implemented?  I have no objection to using it, but I can't seem to find it.  

I've also got no objection to using osc login, but it's not here yet either and I wanted to at least be able to try what I've got, prove that it works, and have a reasonable way to add "get me a token" functionality to an command.