unify and move validation of client certificate to BaseHandler

and re-use it
introduce system.unentile API call

authenticated via the client certtificate/system id file