provider.json is downloaded before ca.crt

We don't assume ca.crt is in /ca.crt anymore, but fetch the complete url
from provider.json.

We also signup against users.json file instead of simple "users", which
worked for *.bitmask.net domains.