allow target script to be requested via HTTPS