Encourage HTTPs, but make it optional (for testing?)