ideally, we'd also control the protocol. We want "always https", but do we want to hardcode that, or protocol-env-set it?