do not require strict checking of ssl certs
make sure to trim app manifests before parsing to remove initial BOM (byte order mark)
thanks to @potch for the tip