Depending on the environment, various exceptions can be risen, so be tolerant
regarding the exception type.

On python 3.5, for each request where SSL authentication fail, even
though application seem functional, a traceback is logged in the log
file.
This makes tests asserting the last log line fail because the last line
is not the access log line, it's the last line of the traceback.

On python >= 3.6, such tracebacks are not logged, so we don't try to fix
this issue but just workaround this for python 3.5. We'll drop this
patch once we stop supporting python 3.5

it seems not enough on out test infrastructure sometimes

pylint understands this and does not report errors about accessing
undefined members.

http://pylint.pycqa.org/en/stable/faq.html#how-do-i-avoid-access-to-undefined-member-messages-in-my-mixin-classes

/reviewed-on nexedi/kedifa!5

It can fail too fast, without giving caucase any chance to start really.

It's better to reply 400 Bad Request on malformed requests and do not pollute
log with exceptions.

Also improve message in case of failure.

/reviewed-on nexedi/kedifa!4

As updater is used in environment, which requires it to have certificates
available as fast as possible, add a prepare step and allow to launch it with
--prepare-only switch.

Thanks to this it is possible to run it with configuration file to provide
fallback or master certificates for all slaves without connecting to the
network, thus resulting in fast preparation.

/reviewed-on nexedi/kedifa!3

Also cover loop method.