enable TLS verification of source map requests if there is a secure token

[graingert]

This change is

[mattrobenolt]

I'm going to close this and re-open an issue because I think this should be an option and not something we just enforce by default. I think the option could be enabled by default, but there'd need to be a way to disable. We'd also need to make sure we surface why this failed inside the UI if it failed strictly because of TLS validation, etc.