Nevermind, don't require SSL client auth

Instead, the login server will provide a session secret (a random
integer) to a user each time they log in to the system. Other hub
services require the client to present a valid username plus current
session secret before going ahead.