Either a client cert or a token or both
Either a client cert or a token or both