In the k8s PROXY-before-TLS setting, we don't know all the IPs
of the load balancers, so we can't whitelist them, so they're at
risk of being d-lined.

This reverts commit a120cc2443.

In the previous commit, the client would receive a failure message but would
actually remain logged in after an authzid/authcid mismatch. This was a
correctness rather than a security issue, but now it's fixed so that the client
never logs in in the first place.

History couldn't be enabled by rehash if autoresize-window was nonzero.

1. If both fingerprint and hash are specified, require both instead of either
2. Implement auto-oper on connect

In particular, allow hostnames without periods (like on a LAN).
This shouldn't be a client compability concern since we allow
vhosts without periods.

* Fix #684
* Fix #683
* Add `CHANSERV CLEAR`
* Allow mode changes from channel founders even when they aren't joined
* Operators with the chanreg capability are exempt from max-channels-per-account
* Small fixes and cleanup