/wsrpc should use the client cert username as the session username

[EliAndrewC]

Moved here from the original (now private) issue tracker.

/wsrpc is assumed to be client-cert protected. Currently the "username" we log for those requests is rpc, but it would be nice to use this as the default, but if a client cert exists with a non-empty CN then we'd use that as the username.

This currently only matters for logging, but this will be relevant when we expose different authentication and authorization methods. In particular, it would be nice to restrict some API calls to only be callable by certain clients.