Allow ssl_certs_dir to be unset.

In some cases we don't want SSLCACertificatePath to be set at all.
If we're using SSLCACertificateFile instead to verify clients we
might want that to be the only CA used. Most other options in this
template are optional, so I don't see why this one can't be too.
Merge pull request #787 from tdb/allow-unset-ssl_certs_dir

Allow ssl_certs_dir to be unset.