all api endpoints should be https.