https by default because I want this to work with file:// URLs

and TLS should just be used everywhere, shut up