specify protocol until we switch to https