that is not completely true.
user usually has ssl on apache.