allow HTTP instead of HTTPS