allow http or https