Fix up comments on HTTPS

Defer to authentication section for guidelines on using HTTPS