ensure https -> rejectUnauthorized uses the default (true)