protected override async Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
{
    ClaimsPrincipal principal;
    var cert = request.GetClientCertificate();
    if (cert != null)
    {
        //authenticate client certificate
        //Set principal from client certificate
    }
    else
    {
        //get AAD token
        //authenticate & set principal
    }
    return await base.SendAsync(request, cancellationToken);
}