simplify Auth.verify_host?

heroku-shadow is gone :} basically never verify if
HEROKU_SSL_VERIFY is set, otherwise only verify for production
change the default manager url to point back to Heroku::Auth

this will continue returning api.heroku.com for most cases, but
allows us to point the Toolbelt to a different endpoint without
having to set HEROKU_MANAGER_URL too.
Merge pull request #1312 from heroku/pedro-customize-orgs-endpoint

Orgs endpoint tweaks