Must realms be defined at an https endpoint like /.well-known/browserid?