Use either password or certificate, depending on headers