X509: don't validate self-signed certs by default