Review and changes from Jocelyn Fiat

I'm not sure whether, for URIs other than "/login", just checking whehter there is an authenticated user or not is enough.
If I remember correctly, the computed hashes, and therefore also the response field, depend on the URI. That could mean that we have to check the challenge for every request...
But I will see.