When appending the SOA for authoritative NXDOMAIN responses, it needs to go in (#151)

the Authoritative section, not the Answer section.

This fixes the acme-dns validation for the lego Let's Encrypt client.