do not verify hosts - bad?