When retrying a replication, make sure to get session & checkpoint

Especially important if the replication initially failed to create a
session or fetch the remote checkpoint, because then we don't have one
at all. (This could have been causing checkpoint conflict errors.)
ChangeTracker should map NSURLErrorUserAuthenticationRequired to 401

The HTTPLogic class returns the lower-level code, but everywhere else
we use 401.
Added unit tests that force replicator auth failures
Fixes for SSL server cert trust checking

* CBLSocketChangeTracker now allows a self-signed cert, provided the
  replicator allows it (i.e. app has configured that root cert.)
* Treat SSL errors as permanent so the replicator will stop on one.
* CBLRemoteRequest now returns the correct error when it comes across
  an untrusted server cert. (Invalid-cert, not auth-canceled.)
Unit tests for SSL replication