status endpoint should, in production, point http users towards https