make protocol (https or http) an option, and default to https