add discardSessionCerts flag for verify callback