disallow BasicConstraints in server certificate.
CA=false is translated to non-existance of this extension in the parser

partial credit to @teh_gerg for forcing me to meditate over these
bits :)