explicitly specify ssl verification
strip newlines from the authorization header
loopback user agents