I realized maybe we should default to never because localhost and hosted environments likely don't have https support

but we document https in the init