add _cn_match() and move to iterative unit testings, this brought
out a set of strange cases, as well as one that should be rejected
because the CN was not an FQDN per the RFC.