Fixed for HTTPS. Broken for HTTP.