What if the scheme is https, and we've got _credentials? We should probably test those credentials, and *then* return true or false.