First hack at x509 auth

Posting this mostly for comments.  I haven't looked at writing the required tests yet.
can we add ```!token``` as a condition for the first part of the if/else? I know ```@can_get_token == false``` implies token is nil, but the logic is easier to follow if that's explicit