Only allow HTTP and HTTPS for curl request (#4703)