Because of the implications to userland code of HTTPS (as in, data is more trusted) this should be a whitelist check. Is there a finite number of "on" values that we can check against? At a minimum this needs a comment.