demo: new server URL, check the cert's principal.email matches UID