I dont think we can assume people are running SSL