Updated version of "X.509 Authentication SASL Mechanism"

[Steve Kille <S.Kille@isode.com>]

In the following message, I am sending round an updated version of the 
X.509 SASL document.  I have fixed a number of problems and added 
clarifications (esp in response to Sean Turner, Chris Newman and Bruce 
Greenblatt).  I hope that the resulting document is now clearer.

I have also added in a mechanism whereby signed tokens can be 
recursively encapsulated.   I believe that this mechanism will be 
particularly helpful to support application firewalls, and also trust 
chains between server applications.


Steve