Change the authenticator API to take request and response.

The previous API takes challenges and returns credentials. This isn't
very flexible because it means our challenge and credentials classes
must model everything.