a README hint at allowing self-signed wss: hosts