Allow self-signed certificates

I presume my use case is pretty common, but I have a self-signed certificate for my development host. This works fine in the browser, where the cert can be trusted. It would be ideal to have a flag like curl to skip verification.

I have a draft PR I will add to this issue shortly.

