watch: SSL/TLS disabled until explicitely enabled in config

so that watch will work "out of the box" when TLS cert not available