Why is this http and not https? Actually, why is it hardcoded?