clients now optionally check the server's cert.