(SERVER-18) Add x-client-dn and x-client-verify support

If `header-dn` has a *bad* value -- i.e. something that doesn't conform to a DN format -- the x500-name->CN call will throw an exception and the request will die.  In the Ruby rack handler implementation, I think they just coerce failure to an empty DN and let the request proceed on unauthenticated.  The resulting failure seems a little more graceful.  I'm thinking we'd want to match the legacy behavior here.