The popLinkWitnessRequired check was placed in the wrong location which
resulted in 0 requests if
popLinkWitnessRequired=false.
Workaround was to always set it to true.
This patch fixes it.
It also adds a missing authenticator CMCUserSignedAuth in CS.cfg for ca.
thanks,
Christina