Add unverified tls transport.
Use an unverified ssl transport if hitting a herokudev environment.
Unescape ampersands so that api.h.c can handle source urls in all environments.