Move authentication code
Update SSL client auth for both direct and proxied mode

Matches the cert CN to the JWT subject field. In proxied mode, it
expects the CN to be provided in the X-Forwarded-SSL-Client-S-DN-CN
header of the HTTP request.