not forcing http only anymore