refactor: one helper for the unverified cross-host credential rule

mayCarry, EnsureAuthForService and tryHelperRetry each spelled out "TLS verification off and another host, so no credentials". A security rule should not be able to drift between copies; crossesHostUnverified now states it once.