Rewritten DDNS processing code to be more sane.

* When transaction security is required
  * Check it first and respond if fails
  * Always attempt to sign answers (if possible)
  * If TSIG required but not sent, return BADKEY and do not parse
    the prereq section - this differs from BIND impl., but it's more
    coherent.