#2121 added an requirement by default that permits access to puppetmaster interfaces if the connection has a trusted client SSL certificate and is from a registered smart proxy host.

It should also support a list of hosts to avoid the need for the proxy. Unsure whether this should bypass the SSL requirement or not.