First hack at x509 auth

Posting this mostly for comments.  I haven't looked at writing the required tests yet.
Could we retry the fallback auth (basic or x509) if we get a 403?  I ask because when a token is missing in OpenShift Enterprise Apache is going to return a 403.