RESTification

This PR closes #23.  It updates the overall flow of the protocol to make better use of HTTP.  There are no changes to the validation challenges.  In case it helps, there's a side-by-side comparison of protocol messages here:

http://www.ipv.sx/tmp/restification.html 
s/considers the client authorized/considers the set of identity authorizations for the certificate to be valid/

This isn't about the client being authorized, is it?  It is about the set of identity authorizations being valid.