Permission bug

- allow the access through http, not only https