Allow HTTP and HTTPS only