authenticator which receives the server certificate fingerprint

it checks the signatures on the chain, certificates need to be valid, and instead
of using a trust anchor the server fingerprint is checked against the provided value
allow intermediate and CA certificates without key usage extensions (pragmatic choice)
instead of accepting all certificates without key usage extensions, only accept CACert's
Merge pull request #26 from mirleft/fingerprint

authenticator which receives the server certificate fingerprint