Don't accept password if not sent over HTTPS