allow "bring your own certs" for ocserv, remove group auto scan