Fix a bug in requiring sendme authentication, and document some future work

The only functional change here is to fix a boolean inversion in auth_sendme_optional.

Previously we were requiring authenticated sendme cells exactly when we should be permitting the old format, and vice versa. (#294 (closed))

This bug was caused by using a boolean to represent one property, but with giving that boolean two different senses without inverting at the right time. (In one case the boolean was "is flowctrl 1 supported?" and in the other it was "is authentication optional".)

When reviewing this branch, it's probably a good idea to go commit-by-commit, since of its 4 commits, 3 are only comments or refactoring.

(This branch also includes comments about when we can change our behavior wrt requiring sendme authentication. (#53 (closed)) I can split those comments out to a separate branch if you'd like: I didn't here, because rebasing them led me to some conflicts.)

Closes #294 (closed).

Closes #53 (closed).