actually distinguish the following BasicConstraint cases:
 CA = false ; _             -> Basic_constraint (false, _)
 CA = true  ; no maxpathlen -> Basic_constraint (true,  None)
 CA = true  ; maxpathlen n  -> Basic_cosntraint (true,  Some n)

and allow only the first for server certificates, the latter two for
CA certificates
good point
Merge pull request #18 from mirleft/fix-basic-constraints

win