make sure requests work even if a user have selfsign cert