reworked file_exists_at_url to detect double --insecure and prevent weired fails, fix #2640, closes #2661