x509 request authenticator

Adds a request authenticator that takes cert validation options and a cert-chain-to-user converter

@erictune PTAL
Just "User" - Get is typically omitted where clear