Symlink keystore for tomcat more reliably.

Previously we would only do this if forcecert was 1, however on a first run for
a devel system, forcecert may not necessarily be set, but certs still get
generated because they do not yet exist. The keystore would not be linked and
tomcat would not run.