Only listen for HTTP challenge when needed.

[bof]

As I'm right now only using manual challenges, I was surprised that the code nevertheless listened on 127.0.0.1:8080 during "acme cert".

This change moves the listening setup inside the appropriate case. UNTESTED, but it looks trivial ;-)