allow user to use unsafe (e.g., http connection) to api server

sometimes this is necessary, since the api server may be remote, and
just can not provide a https connection.