Fixed error handling in geo ip lookup closes #2011

Mind taking a look at this @aranhoide?
(This is not introduced in this change, but) Flashlight itself comes with a set of baked in masquerades (including certs) for bootstrapping, and the cloud config will give it up-to-date ones.  What is the point of this `DEFAULT_HOSTS_TO_CERTS` mapping?  Won't it also become obsolete as soon as we start using the same set of root CAs for all masquerades?