move verify_api_cert to its own setting