changes to support peer to peer stunnel

I wanted to create some peer to peer tunnels, and needed 1) strict authentication of both the client and the server, and 2) client and server endpoints both running on the same box.

I changed the API around a little bit so I could get what I wanted; perhaps you'll prefer a slightly different approach.