Instead of the box posting a "client_id" discern it from the client certificate used to POST.

Currently a "client" field must be POSTed, ideally we should use a client cert and use the fingerprint of this certificate to identify the client (where the client is a box).

It's not done like this right now as the Iron Framework does not support this easily as it is right now.
