Add missing CAC error page

See merge request !117

Remove expired Letsencrypt certificates

See merge request !116

bug fix, features added.

See merge request !115

Override is okay for new registrations, but if someone overrides to use an alternative ID for existing registrations, they will lose ability to reset password for their original account. 

Update api.php to include support for users who cannot figure out how to select their email certificate and it's just not worth the effort to teach them how to select the correct certificate. 

Includes support for users without email certs to create an alternative user ID, and a check to query if a user has that alternative ID before letting them create a new account.