This should probably be https, or protocol specific to the caller's SSL/not SSL?