- in a proxied setup base_url is not just the combination of host+port, in this
  case use base_url to specify your outside endpoint
- even in non-TLS mode enable client authentication when a key and certificate
  are specified