Puppet 3: Update with new info about unverified HTTPS requests

I checked it and was wrong: it only verifies the master's cert in
fully-verified connections.