shouldn't the redirect URI be https?