more properly default to https unless http is totally explicit