The control flow (with `make_eamap` and `do_mit`) is pretty convoluted. I think it would at least be clearer if both the setup (current inside the `if do_mit` block and the external auth registration (inside `if make_eamap`) were controlled by a single setting about whether to set up SSL external auth accounts.