we might run under HTTPS, so let the browser decide which protocol to use