Do certificate verification call ourselves.

For Go 1.3, because too many people were getting the crypto/tls API
wrong, I changed it. It's now required that either InsecureSkipVerify or
ServerName is given. The previous behaviour of verifying a chain and
then using VerifyHostname on the connection is dead.

Because of this, xmpp needs to change. This change causes
InsecureSkipVerify to always be set. Unless we have a SHA-256
fingerprint for the certificate, we now do the verification ourselves in
order to model the old crypto/tls behaviour.
Support XEP-0203.

Thanks to Peter Stuge.