Error callback

I added an failure callback so you can try another auth mechanism if the ACL fails. This allows you to use this as "must-be-from-this-address OR provide login details" middleware.

I can't shake the feeling that Express should allow me to chain this stuff without explicitly providing for it in middleware, but I can't think of how.