user-manager is protected by iam. Still using http and the default settings.