allow testing bitmaskcfg against menshen on localhost

In order to help with the development of https://0xacab.org/solitech/jnk-compose and https://0xacab.org/leap/jnk it would be useful to be able to omit TLS for the API communication with a deployment on localhost.

This should be a development flag and clearly described as such and probably even not a public API.