clean up client certificate confusion
the problem: it is a very confusing user experience to deal with anonymous certificates. what happens when you log in? can you switch back? etc.
solution:
(1) once you make a choice to "use anonymously" or not at the provider selection stage, this choice is fixed. from then on, that provider will only be used in the manner you picked (either always anonymously or always require personal certificate).
(2) if the user wants to change this behaviour, they can 'switch provider'.
(3) maybe we should rename 'switch provider' to 'setup provider'.
If something happens that makes anonymous certificates no longer work, then it should dump the user back to the provider selection screen after giving the user a message like: "It is no longer possible to use this service provider without authentication. Please select another provider." This might happen if eip-service.json is updated and anonymous is no longer supported.
(from redmine: created on 2015-04-24)