"optional" in the server, so we have to check more carefully in the
script that the client supplied a proper certificate.

Also, the server is now exporting the entire client certificate so
that we can pull out the URN from it. UUIDs are slowly being phased
out. This change requires some new ports installed on boss:

 "p5-Crypt-OpenSSL-X509" => "/usr/ports/security/p5-Crypt-OpenSSL-X509",
 "p5-Crypt-X509"         => "/usr/ports/security/p5-Crypt-X509"