make authorized redirect part of the constructor
check for certificate else revert to insecure mode
remove verbose logging for sample