re: CA proxy -- possibly, but not sure: if for some weird reason puppet CA proxy exists, but there is no puppet proxy, I think it's safer to respect that.

re: only initialize puppet_proxy_id when it's not set -- possibly? Although I'd think it's safe to update the proxy id if the request came from it (even more so if there's only one proxy).