Couldn't get client authentication to work from ruby (see comment for details) so we had to make a system call to curl instead