Not providing mutual authentication

[mkomitee]

I noticed today that we're not actually authenticating the server responses. In handle_401 we call authenticate_user and return the resulting response to the caller, handle_response, which passes it back to the user. Under normal circumstances, we never call handle_other, which is where mutual authentication occurs.

I'm a bad person and I feel bad.

I have a fix in my fork, but I'm not submitting it yet because it breaks tests.

[mkomitee]

For those who are interested in getting it before I can fix the test, the fix is at mkomitee@17497b8