default to http if req.protocol is not defined (it should be!)