use HTTPS instead of HTTP. manifest plist file needs to be served over SSL