RESTification

This PR closes #23.  It updates the overall flow of the protocol to make better use of HTTP.  There are no changes to the validation challenges.  In case it helps, there's a side-by-side comparison of protocol messages here:

http://www.ipv.sx/tmp/restification.html 
Hmm, this PRIVATE thing has me concerned now.

If this information is provided by the client, then the server can store that information.  Maybe it can provide clients with a hash of what it has so that clients can reassure themselves.