add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
osin and osincli don't take advantage of the built in json encoding/decoding for objects.  They first transform the data to an from maps.  Having this object lets me go direct into an object with declarative encoding/decoding rules as opposed to using the osin way.  See https://github.com/openshift/origin/blob/master/Godeps/_workspace/src/github.com/RangelReale/osin/info.go#L66 and https://github.com/openshift/origin/blob/master/Godeps/_workspace/src/github.com/RangelReale/osin/example/simple/simple.go#L104.