First hack at x509 auth

Posting this mostly for comments.  I haven't looked at writing the required tests yet.
I'm confused why this had to switch around... why can't we try the token if we have it? If the token gets rejected, the token will get set to nil and we should fall through to the next case on retry, right?