add https caveat