pkcs11: avoid callig _gnutls_bin2hex() when length is zero.
p11tool: Do not allow a newline as PIN.
gnutls_pkcs11_privkey_generate2(): corrected public key extraction (for ECDSA keys)
p11tool: don't outsmart user and override login type

Unfortunately tokens vary on their requirements for writing trusted
and private objects, and there is no one-size fits all policy. Thus
allow a proper failure and warn the user that so-login may be required.
Added so-login flag to force security office login to the card
doc update
updated auto-generated files
pkcs8: initialize parameters on decryption
doc update
pkcs11: Allow verification with structures that support other than HMAC-SHA1 MACs.
tests: test the decoding of a PKCS #12 structure with SHA256 MAC

Conflicts:
	tests/pkcs12-decode/pkcs12

Conflicts:
	tests/pkcs12-decode/Makefile.am
tests: updated string to keys tests for new internal API
doc update
when checking the hostname of a certificate with multiple CNs use the "most specific" CN

In our case we use the last CN present in the DN. Reported
by David Woodhouse.
tests: check that gnutls_x509_crt_check_hostname() will correctly use the last CN when multiple
doc update
bumped versions
record: in DTLS discard only messages that cause unexpected packet errors
doc update
record: tolerate a finished packet with errors in DTLS