disable STS by default to work with self signed certs