http, no SSL enforcement