RESTification

This PR closes #23.  It updates the overall flow of the protocol to make better use of HTTP.  There are no changes to the validation challenges.  In case it helps, there's a side-by-side comparison of protocol messages here:

http://www.ipv.sx/tmp/restification.html 
s/represented/identified/

Drop the SHOULD, this is axiom:
Client complete the challenges identified in at least one of the sets in this collection to make the authorization valid.

If this value is omitted, clients complete all challenges to make the authorization valid.