... and then go through the "normal" HTTP engine.

Check the NPN result before preparing an HTTP request and switch into
HTTP/2.0 mode if necessary. This is a work in progress, the actual code
to prepare and send the request using nghttp2 is still missing from
Curl_http2_send_request().

To better reflect its purpose

NPN is what is available in the wild today to negotiate SPDY or HTTP/2.0
connections. It is expected to be replaced by ALPN in the future. If
HTTP/2.0 is negotiated, this is indicated for the entire connection and
http.c is expected to initialize itself for HTTP/2.0 instead of
HTTP/1.1.

see:
http://technotes.googlecode.com/git/nextprotoneg.html
http://tools.ietf.org/html/draft-ietf-tls-applayerprotoneg-04

This makes it easier to trace what's happening.

the number of elements in the 'nghttp2_session_callbacks' structure is
now reduced by 2 in version 0.3.0 (I'm not sure when the change
happened, but checking for ver 0.3.0 work for me).

Something is wrong in 'userp' for the HTTP2 recv_callback().  The
session is created using bogus user-data; '&conn' and not 'conn'.

I noticed this since the socket-value in Curl_read_plain() was set to a
impossible high value.

Fixed two compiler nits

...until the function is successful when it returns them in the out
parameters.

Added conversion functions write32_le() and write64_le() to ensure the
NTLMv2 timestamp is always written in little-endian.

It is not provided by NSS public headers.

Bug: https://bugzilla.redhat.com/1058776

... that the user does not ask for

hostcache_timestamp_remove() should remove old *unused* entries from the
host cache, but it never checked whether the entry was actually in
use. This complements commit 030a2b8c.

Bug: http://curl.haxx.se/bug/view.cgi?id=1327

tftp_done() can get called with its TFTP state pointer still being NULL
on an early time-out, which caused a segfault when dereferenced.

Reported-by: Glenn Sheridan
Bug: http://curl.haxx.se/mail/lib-2014-01/0246.html

Incorrect password if use backspace while entered the password.

Regression from f7bfdbab

The '?:' operator has lower priority than the '-' operator