I can do that. Why is bad to default to isSecure here though? It seems like the much more common scenario (development for one), and if https is on, it would still be passed through securely, correct?