Nope, http and https are both valid. The protocol is required in the listed realm argument (wsapi/realm_info validates its a proper `origin`).