avoid --insecure curl option in testing

[theyoyojo]

perhaps we can trust the self-signed certs's CA as a legitimate root CA for development so we can do hostname verification. --insecure disables all verification which is overkill and reduces test coverage