fix authorization header
update self-hosting doc to remind you to turn off trust_host_root_certs if you're signing with your own CA