replace php curl with WP HTTP class.

Only the peer is verfied.
WP HTTP class does not differentiate between the certificate itself
and the hostname.

Closes #2