Drop github.com/tstranex/u2f as the implementation, in favor of
github.com/duo-labs/webauthn.

The clients already support it (via the default net/http.Transport),
and it can be enabled with a configuration parameter. The default is
still currently disabled, though there is plan to flip it later to
enabled-by-default if it proves to be working as expected in
production.

We also introduce, via a slight refactoring of the Serve() code, a
test of the top-level http.Handler (with the full middleware stack).

Use mime.ParseMediaType to obtain the main content type.

This reverts commit f8bba073.

That version is incompatible with go 1.11 (debian).