authorization for replication

Here the client connects, authorizes, and then replication starts only after the remote has authorized, and only if they authorized as a peer.

This also makes it easy to support adding additional remote keys to a scuttlebot (so we can have a bot that multiple people could post from, for example), and this also leads directly to having applications or web sites that may log in to your scuttlebot instance.
`{allow: null, deny: null}` means they can do _anything_. so this is when the local ui connects.