Add auth=any to the crl endpoint

Because the crl should be retrievable anytime, from anywhere. Also
because it makes it possible to stand up multi-tier Puppet
infrastructure piece by piece.