borth crt & crtKey are optional now, x-auth-token is required only for https flag #1