Add ability to manually refresh an ACME certificate

[ecton]

Somewhat related to #171, we should have a way to explicitly ask our ACME service to request a renewal ahead of time. Currently the only way to do so is to delete the existing cert and restart the server.