if mech supports mutual auth, assert it