Off by default (security risk), but users can
wire it up if desired.

Fixes #2113

R=rsc, bradfitz
CC=golang-dev
https://golang.org/cl/4959049