allow unauthorized certs for headers()