RESTification

This PR closes #23.  It updates the overall flow of the protocol to make better use of HTTP.  There are no changes to the validation challenges.  In case it helps, there's a side-by-side comparison of protocol messages here:

http://www.ipv.sx/tmp/restification.html 
Do you show the recovery token once it is validated?