[doc] HTTPS by default