UAExpert sends its application certificate as client certificate in the initial `CreateSessionRequest`.
The user certificate is sent as `ua.X509IdentityToken` in the request body and has to be looked up there.