fix needing to authenticate when fetching CRL, add Last-Modified header to CRL response