connection, the child needs it since we do not accept CLI here
documents on unauthorized CLI connections.

Make the mgr-child CLI connection authorized in the child so we
accept CLI here documents.

Add testcase for this.

Fixes #917