First hack at x509 auth

Posting this mostly for comments.  I haven't looked at writing the required tests yet.
I'm still thinking through the removal of "&& !(options.rhlogin && options.password)".  I'm assuming that was so fall back to password auth if the user specified it on the cli.