I think the order is wrong here - it's possible to end up with verify=True for normal http calls.