clarify changing to https