userProfile endpoint: use https instead of http