This enables forcing HTTP/1 (for proxies).

Instead of a socket file descriptor, client sessions are now run on
top of an abstract I/O stream. This enables e.g. TLS over TLS, which
would be required for HTTPS through HTTPS proxy.

...from common code. And document.

Anonymous key exchange is not supported currently.

This (partially) enables running TLS over something else than a plain
TCP socket file descriptor.

(demux_Packetizer... could use some factorization with decoder_...)

Shallow fix only, but improved rationalization

 - Never save guest credentials
 - Don't save password in options if it's in the keystore

This reverts commit 76ae877d.

refs toon.avi

avoids failing with delayed start tracks