This adds some workarounds for old style auth headers in URL auth.
The old code did not check buffer lengths. Buffer overflow seems
possible.

This also adds a new handling that replaces the old one and has a
much cleaner interface. This should be used for future software.

Feature: Added new <role> properties: match-method, and nomatch-method. This is more inline with the other properties