made the TLS_REJECT_UNAUTHORIZED a package.json based config toggle... package.json by default has insecure=false.  must set to true during testing with self-signed certs