Why not use https if possible?