making it work without https