add challenging authentication needed for cli

Adds the ability to issue authorization challenges back to callers of /authorize.  This is done based on the value of client.RespondWithChallenges which indicates that a particular client wants to be challenged for responses instead of being redirected.

This also adds a few new cli commands (request-token, validate-token, whoami) to exercise the new capabilities.  Right now, the command line client only recognizes basic auth challenges, but the code point for future extension to other challenges is present.

@liggitt review
Is this a temporary debug command?  Or the seed for something longer terms. If we're sure it's the latter let's move it to pkg/cmd.