Optionally, retain only SHA-256 of client cert.

Adds an option to retain only the SHA256 of a client certificate in
memory and in the serialized session state.