make SSL verification configurable, default is false