drop webfinger, see #95
make a self-signed certificate on a non-primary domain a warning rather than an error, fixes #95