default to not verifying SSL cert of statistics (unlikely for people to do the right thing here), move log message about serverlist url to only emit when using it, improve example config