only http or https