Password authentication over Gemini

[solderpunk]

I deliberately chose not to spec any kind of password-based
authentication in Gemini, since TLS was already mandatory and so client
certificate authentication was a possibility.  The "maximise power to
weight ratio" philosophy kind of implies a "there should be only way to
do it" philosophy as a corollary.

Anyway, I realised to my surprise yesterday morning that actually Gemini
now supports password authentication quite readily:

CLIENT:    gemini://example.com/protected-resource/
SERVER:    61 Please supply a temporary certificate to faciliate
           interactive login
CLIENT:    gemini://example.com/protected-resource/
           (with disposable certificate)
SERVER:    10 Username:
CLIENT:    gemini://example.com/protected-resource/?solderpunk
SERVER:    10 Password:
           (after storing "solderpunk" in memory, indexed by client
	   certificate fingerprint)
CLIENT:    gemini://example.com/protected-resource/?hunter2
SERVER:    21 text/gemini
           (after retrieving "solderpunk" from memory and verifying that
	   solderpunk/hunter2 matches what is stored (hashed and salted)
	   in a database

This is less hassle than using client certificates directly (i.e.
generate a persistent certificate, email the fingerprint to the remote
admin, carry your certificate around with you, all as per ssh keys),
though of course also less secure (weak passwords can be guessed,
password databases can be stolen).  Different approaches will be more or
less appropriate for different applications.

This motivates two possible changes to the spec:

Firstly, the <META> value sent with a 6x status is currently undefined.
I would propose that for 61, <META> should be a human-readable message
explaining *why* the server is politely requesting the user to
voluntarily and temporarily surrender their anonymity.  Seems only
reasonable.

Secondly, as a variant on 10, maybe 11 could carry the extra semantics
that clients should not echo user input, so it can be used for things
like passwords.

Any thoughts?

-Solderpunk