Allow extracting the SSL connection factory from client auth classes

The client auth classes are needlessly restricting; they don't really
need to be creating the HttpClient for us, they are really just a means
for an SSLConnectionSocketFactory. This makes that more explicit.
Allow configuring httpClient; move new servlets to servlet package