do not try to verify client certificates

This is never used and should be left for the administrator to configure