Feature flexible auth

[vault]

These commits make the use-case I had for pyshop possible.

What I'd like is for pyshop to run behind a single sign-on service, but still permit uploads and downloads that don't go through that service (since those are usually onerous outside of a browser). In my case, I'd want to allow client-cert authentication to be sufficient for downloading packages. The problem is that it's currently impossible to upload packages with client cert auth due to limitations in distutils. This branch works around that by allowing uploads and downloads to happen on different endpoints, and making it possible to configure different auth methods for those endpoints.

See the commit messages for more details.