Fixed client certificate auth and create-service-token

Client certificate auth was broken, the server was allowing
unauthorized certificates to connect; added a check to make sure
the client cert is authorized.
The create-service-token command broke with the new PKI signing
for authentication tokens; added code to fix it.