initial take on adding support for tls auth with client certificates