Return only the ca instead of ca-ra cert for the first step of scep enrollment

I'm not sure why this is needed, but sending back duplicate certs with the ca-ra mime type wasn't working.  This might deserve more investigation if someone is implementing this with a true CA instead of just issuing certs off a self-signed/normal cert.  

Also fixed a small typo in the example app that prevented it from running out of the box.