i think for developers its easier to do http or https, lets limit it on prod etc. to https