Provide client-certificate Authentication backend (PKI)

This is critical for some of our customers.

Request that it be possible to configure Hue to request client certificates when doing a TLS handshake (I believe this is possible with CherryPy) and for a Django backend to extract the CN from the certificate's Distinguished Name for use in the session (groups will still need to come from a different Authentication backend). Client-certificate would need to be signed by a root CA that's in Hue's truststore.