Cleanup some old XXX needed comments. cert_parse() returns a referenced

Cleanup some old XXX needed comments. cert_parse() returns a referenced
x509 object from the call and that reference needs to be freed. There is
a second inside of struct cert but that reference is still held.
So the  X509_free() calls are indeed needed and by moving them up a bit
the code gets a bit simpler too.
With and OK tb@