This replacement of verify is wrong, it should use the verify that's defined above, since it's an api request it should only validate against the ca cert that was downloaded at provider bootstrap time.