The lowest last id  client can get ever have is 1 (0 is special), so first event must be 2, otherwise event with id 1 may get lost (thx bodik@cesnet.cz)

Cert checking now works correctly in both "SSLVerifyClient required" and "SSLVerifyClient optional" (authenticators do safety check themselves)

Added combined X509MixMatchAuthenticator, which allows for logging in both clients with hostname cert and with client name cert

Fixed first client's access without id (IndexError: tuple index out of range) (thanks to Radko Krkos)