Change role detection from hostname to clientcert

This allows non-hostname-compliant nodes to install with
the correct role