Please emphasize that all the following interaction **must** happen over https.