Auth handlers should use HTTPS by default.