fix reading
trashy api clients

- split out
tweak cert paths

symlinks ftw
plumb the host name from connect down to tls