core: BoxAdd now works with HTTP URLs