websocket needs to respect `options.secure` too