add note about disabling SSL