Turns out we really did want to use SSL/https :(