x509 request authenticator

Adds a request authenticator that takes cert validation options and a cert-chain-to-user converter

@erictune PTAL