Add authenticated TLS support to the client.

It will work in both places. (since the auth file is just a serialized AuthInfo struct)  I'm in favor of flexibility, since you may generate different user/password for each cluster, but use a shared CA file.

But if you feel strongly, I'll remove the flags.