verify https maps to wss; set secure default for client test; refactor anonymous resource checks