Sealed client-auth (register/login/upgrade) over the crypto session.

Breaking change: plaintext client-auth bodies no longer work when CRYPTO_ENFORCE=true.