Re-challenge when difficulty increases across requests

#365 removed the checks on the claims of the cookie because of problems caused by legitimate clients using different IP addresses (which seems reasonable).

But this also makes page-specific difficulties less meaningful since if there's a page with an "easy" difficulty, then accessing that page first before more difficult pages would bypass the harder difficulty.

I think some form of check should be re-introduced to handle when there's an increase of difficulty in the challenge that would be given if the client didn't have a cookie.

Possible implementation

The difficulty can be extracted from the claimed challenge by counting the leading zero bits or nibbles of the sha256sum of the concatenation of the claimed challenge and nonce (assuming that is true for all algorithms, which might not be anymore with #240), or simply directly use the response claim, and then re-challenging when the required difficulty is higher.

Or the difficulty could be explicitly added to the claims (which are trusted anyway since #365), and this would not depend on how the challenge is validated.

Both approaches would also gracefully handle decreases of required difficulty (since a higher-difficulty cookie will still be accepted for a lower-difficulty request) when the algorithm is the same.

Not sure how to handle difficulties across algorithms, though.

Start by reading the changes in #365 and the challenge-validation assumptions referenced in #240, then trace how cookie claims and per-page difficulty are handled across requests. Done means a cookie issued for an easier challenge cannot bypass a higher required difficulty, while lower difficulties remain compatible and algorithm differences are addressed.