Fix issues:

* unauthenticated requests don't use the subdomain, so don't carry in env
* otoh, let API impls pass a different host.
* in fact, let them create a base Request
* http-client doesn't change the port when 'secure', so set to 443
* event submission response is an object