wafer: only ask for client certs on the login page