Use HTTPS when oauth is not overriden. Fixes #326