Connect must be enabled in order to use this endpoint

Getting this continuously on client after following the tutorial and trying to switch into production mode:
```
2019/12/05 20:32:34 [ERR] consul: "ConnectCA.Roots" RPC failed to server 192.168.112.3:8300: rpc error making call: Connect must be enabled in order to use this endpoint
2019/12/05 20:32:34 [ERR] consul: "ConnectCA.Roots" RPC failed to server 192.168.112.4:8300: rpc error making call: rpc error making call: Connect must be enabled in order to use this endpoint
2019/12/05 20:32:34 [ERR] consul: "ConnectCA.Roots" RPC failed to server 192.168.112.3:8300: rpc error making call: Connect must be enabled in order to use this endpoint
2019/12/05 20:32:34 [ERR] consul: "ConnectCA.Roots" RPC failed to server 192.168.112.4:8300: rpc error making call: rpc error making call: Connect must be enabled in order to use this endpoint
```

This endlessly appearing entirely cryptic message doesn't help at all. I'm trying start fresh with client config, it's been connected to servers and servers are in sync. I've deleted `/consul/data` to get rid of stale crap.

`consul leave` on client should really delete all stale data, if any was left from previous operation. This is client, not server, it should self-destruct and let me start anew.

Client info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 1
build:
prerelease =
revision = 1200f25e
version = 1.6.2
consul:
acl = disabled
known_servers = 2
server = false
runtime:
arch = amd64
cpu_count = 8
goroutines = 95
max_procs = 8
os = linux
version = go1.12.13
serf_lan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 2
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 48
members = 3
query_queue = 0
query_time = 1

$ consul members
Node Address Status Type Build Protocol DC Segment
srv-1 192.168.112.3:8301 alive server 1.6.2 2 chi2
srv-2 192.168.112.4:8301 alive server 1.6.2 2 chi2
client1.hk.local 192.168.112.6:8301 alive client 1.6.2 2 chi2

```

Server info

```
agent:
check_monitors = 0
check_ttls = 0
checks = 0
services = 0
build:
prerelease =
revision = 1200f25e
version = 1.6.2
consul:
acl = disabled
bootstrap = false
known_datacenters = 1
leader = true
leader_addr = 192.168.112.3:8300
server = true
raft:
applied_index = 201
commit_index = 201
fsm_pending = 0
last_contact = 0
last_log_index = 201
last_log_term = 2
last_snapshot_index = 0
last_snapshot_term = 0
latest_configuration = [{Suffrage:Voter ID:5b9b3670-3d34-b352-f3bc-91dc904ac694 Address:192.168.112.3:8300} {Suffrage:Voter ID:cd2b23a8-db46-1a0d-07b9-9361475f8030 Address:192.168.112.4:8300}]
latest_configuration_index = 1
num_peers = 1
protocol_version = 3
protocol_version_max = 3
protocol_version_min = 0
snapshot_version_max = 1
snapshot_version_min = 0
state = Leader
term = 2
runtime:
arch = amd64
cpu_count = 8
goroutines = 97
max_procs = 8
os = linux
version = go1.12.13
serf_lan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 2
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 48
members = 3
query_queue = 0
query_time = 1
serf_wan:
coordinate_resets = 0
encrypted = false
event_queue = 0
event_time = 1
failed = 0
health_score = 0
intent_queue = 0
left = 0
member_time = 18
members = 2
query_queue = 0
query_time = 1

```

Start by reproducing the client behavior from the tutorial in production mode and trace the ConnectCA.Roots RPC errors against the supplied client and server configurations. Then inspect the consul leave behavior and stale client state handling; done means the recurring error is explained or made actionable and a client can leave and restart cleanly.

Written by the indexing model from the issue text.