JSON file was moved to WEB-INF
Require SSL to all external requests except localhost