I havn't yet figured out how to use Android's system CA certificates
with CURL/OpenSSL, so a temporary workaround is to disable verify_peer
by default.  The data MPD transfers isn't extremely important, so the
servers's authenticity isn't extremely important either.