First hack at x509 auth

Posting this mostly for comments.  I haven't looked at writing the required tests yet.
I updated the PR to keep the maintain the current behavior of allowing the user to override token authentication if they specify their username and password.