allow unverified SSL certificates on mercurial repositories

See diff, allows insecure (e.g. unverified mercurial repositories).
This fixes handling PRs from Julien Gormotte ;)

I'm also open for "better implementations"...