Don't mix up pre- and post-handshake verification of clients.