authorization for replication

Here the client connects, authorizes, and then replication starts only after the remote has authorized, and only if they authorized as a peer.

This also makes it easy to support adding additional remote keys to a scuttlebot (so we can have a bot that multiple people could post from, for example), and this also leads directly to having applications or web sites that may log in to your scuttlebot instance.
Why is this `granted: true` when permissions aren't changed? Also, what's the difference between peer and client here?